What is the CVSS score of CVE-2026-20124?

CVE-2026-20124 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Cisco IOS XE are affected by CVE-2026-20124?

Cisco IOS XE Software's SNMP subsystem contains a denial-of-service vulnerability allowing authenticated attackers to force device reloads and trigger network-wide outages.

How to fix or mitigate CVE-2026-20124?

Within 24 hours, inventory all Cisco IOS XE devices in production and identify which are running affected versions (3.x, 16.x, or 17.x trains) with SNMP enabled; also document SNMP access restrictions and current authentication controls. Within 7 days, restrict SNMP access via network access control lists (ACLs) to limit which networks can send SNMP queries, or disable SNMP entirely if not required for network operations and monitoring. Within 30 days, monitor Cisco security advisories for a patch release and develop a staged upgrade strategy for migrating affected devices to patched versions once available, prioritizing mission-critical devices and core network infrastructure.

Cisco IOS XE CVE-2026-20124

EUVD-2026-53449 HIGH

Missing Release of Resource after Effective Lifetime (CWE-772)

2026-08-05 cisco

GHSA-rxc8-wwjf-p7fp

Denial Of Service Apple Cisco Cisco Ios Xe Software

7.7

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

7.7 HIGH

SNMP is network-accessible (AV:N); valid credentials required (PR:L); device reload cascades to downstream network (S:C); no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:31 vuln.today

CVE Published

Aug 05, 2026 - 16:18 nvd

HIGH 7.7

DescriptionCVE.org

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition.

This vulnerability is due to improper error handling when parsing SNMP requests. This vulnerability affects all versions of SNMP — Versions 1, 2c, and 3. An attacker could exploit this vulnerability by sending a malformed SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly. The attacker must have the SNMPv1 or v2c read-only or read-write community string or valid SNMPv3 user credentials on the affected device.

AnalysisAI

Denial of service in Cisco IOS XE Software's SNMP subsystem allows an authenticated remote attacker to force an affected device to reload by sending a malformed SNMP request, disrupting all traffic transiting the device. The vulnerability spans all three SNMP protocol versions (1, 2c, and 3) and affects an exceptionally broad version range across both the 3.x, 16.x, and 17.x release trains. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope-change rating (S:C) reflects that a device reload cascades into a network outage for all downstream systems dependent on the affected device.

Technical ContextAI

Cisco IOS XE is the Linux-based network operating system powering Cisco's enterprise routing and switching portfolio. The vulnerability resides in the SNMP subsystem's request-parsing code path, where improper error handling (CWE-772: Missing Release of Resource after Effective Lifetime) fails to gracefully recover from a malformed packet, instead triggering an uncontrolled device reload. CWE-772 typically manifests as a failure to release a resource - such as a memory buffer, socket, or process handle - after an error condition, which can produce a fatal fault or watchdog-triggered restart. Critically, the flaw exists in a code path shared across all SNMP versions: SNMPv1, SNMPv2c (community-string based), and SNMPv3 (user-based security model with authentication and privacy), indicating the vulnerable parsing logic is not version-specific. The CPE identifier cpe:2.3:a:cisco:cisco_ios_xe_software:*:*:*:*:*:*:*:* covers the entire product line with no platform exclusion noted in available data.

RemediationAI

Consult the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-snmp-dos-ZAqNm4MD for specific fixed software release versions, as exact patched version numbers are not confirmed in the available input data and must be verified directly from Cisco. As an immediate compensating control, restrict SNMP listener access using infrastructure ACLs (iACLs) or Control Plane Policing (CoPP) policies to permit UDP/161 traffic only from known, trusted NMS (network management station) hosts - this is the highest-impact mitigating step, as it prevents attacker-controlled hosts from reaching the SNMP service even with valid credentials. If SNMP monitoring is not operationally required on a given device, disable it entirely using 'no snmp-server'; this eliminates the attack surface with no side effects for unmonitored devices. For devices where SNMP must remain active, rotate all SNMPv1/v2c community strings and SNMPv3 credentials immediately and enforce strong, unique values per device to reduce credential-exposure risk. Note that disabling individual SNMP versions (e.g., disabling v1 or v2c) does not mitigate the vulnerability, as all three versions are affected and the flaw exists in shared parsing logic.