Cisco Ios Xe Software CVE-2026-20104

The risk assessment reveals a significant disconnect between the CVSS 6.1 score and the actual threat level. The CVSS vector (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects Physical access vector, Low complexity, and No privileges required, with High impact on confidentiality and integrity but No impact on availability. However, the vulnerability's real-world criticality is elevated by several factors: (1) it breaks secure boot, a foundational security boundary; (2) it affects enterprise-grade network infrastructure (Catalyst switches) deployed in critical environments; (3) the attack surface includes both authenticated local attackers with level-15 privileges and unauthenticated attackers with physical access, making it exploitable in supply chain and insider threat scenarios; (4) the widespread affected version range (17.3.x through 17.18.x, plus 16.12.x) indicates a large installed base. The ENISA EUVD listing and Cisco's deliberate uprating to High SIR signal vendor acknowledgment of the boostrap compromise severity. Without KEV/CISA status or confirmed POC availability noted in provided intelligence, exploitation likely remains limited to well-resourced adversaries, but the bootloader-level impact means this is a priority for organizations running affected Catalyst switches in sensitive network segments.

An insider or supply-chain attacker with physical access to a Catalyst 9200 switch could connect to the device, access the bootloader or flash storage, and systematically modify the loaded IOS XE binary to inject malicious code or disable integrity checks. During the next boot cycle, the compromised bootloader would execute the modified binary, establishing persistent root-level control before the operating system fully loads. The attacker could then establish backdoor access, exfiltrate network traffic, or laterally move within the enterprise network while remaining undetected by operating-system-level monitoring tools. Alternatively, an authenticated attacker with level-15 administrative privileges could manipulate binaries in flash memory and reboot the device to achieve the same effect, making this a privilege-persistence and supply-chain threat vector.