EUVD-2026-53453
GHSA-fhmv-662f-c3vp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Remote unauthenticated access-control/auth bypass (AV:N, PR:N) but non-trivial preconditions justify AC:H; changed scope and full C/I/A impact match a critical device compromise.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20267 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.
AnalysisAI
Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to gain unauthorized access with a scope-changing impact affecting confidentiality, integrity, and availability across affected components. The issue was discovered internally by Cisco's engineering team during a proactive security review and is grouped under CWE-284 with a CVSS base score of 9.0, though the high attack complexity (AC:H) indicates non-trivial preconditions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector (AV:N/AC:L-inverse AC:H/PR:N/UI:N) indicates remote, unauthenticated exploitation with no user interaction, but the High attack complexity (AC:H) means non-default or attacker-uncontrollable conditions must be met for a reliable attack - for example a specific feature or management service being enabled and network-reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 9.0 (Critical) is driven by network attack vector (AV:N), no privileges (PR:N), no user interaction (UI:N), a changed scope (S:C), and full C/I/A impact - but tempered by high attack complexity (AC:H), meaning the attacker needs specific conditions or timing beyond a simple request. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker with network reachability to an exposed Cisco IOS XE device's management plane leverages an improper access-control weakness to bypass authentication or authorization and reach protected functionality, then uses the scope-changing flaw to affect components beyond the initially vulnerable one. Success requires meeting the high-complexity preconditions (specific configuration, state, or timing), and no public exploit code is currently known to exist. |
| Remediation | Upgrade to a fixed Cisco IOS XE release as directed by the Cisco Security Advisory cisco-sa-hardening-iosxe-V8NMuMZJ (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ); because the input does not include a single authoritative fix version and the affected list spans many trains, use the advisory's Fixed Software section and the Cisco Software Checker to map your exact running version to the correct hardened build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cisco IOS XE devices in production, document current versions, and assess exposure based on network access controls and geographic distribution. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Ios Xe Software
View allImproper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthentic
Denial-of-service via malformed XMCP packets forces unexpected reloads of Cisco IOS and IOS XE devices, exploitable by a
Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticate
Unauthenticated remote denial-of-service affecting Cisco IOS XE Software across a wide version range results from multip
Unauthenticated remote denial-of-service in Cisco IOS XE Software allows network-accessible attackers to crash IOS proce
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discovera
Unauthenticated remote attackers can cause high availability impact with scope change on Cisco IOS XE Software through i
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a com
Denial of service in Cisco IOS XE Software's SNMP subsystem allows an authenticated remote attacker to force an affected
Denial of service in Cisco IOS XE Software's web-based management interface allows an authenticated remote attacker with
Denial-of-service in Cisco IOS XE Software's web-based management interface (WebUI) allows an authenticated remote attac
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today