EUVD-2026-53458
GHSA-cgmj-4p58-cx74
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-74 injection reachable over the network with no auth or interaction and full device compromise supports AV:N/AC:L/PR:N/UI:N and C/I/A:H, matching Cisco; scope kept Unchanged absent evidence of cross-component impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20272 are related to issues with improper neutralization of special elements that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.
AnalysisAI
Improper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthenticated attackers to compromise the confidentiality, integrity, and availability of affected network devices, per Cisco's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical). The flaw was found during an internal Cisco security review and fixed via software hardening releases; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required, implying remote unauthenticated exploitation once the vulnerable component is reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector is maximal for an unauthenticated network attack (AV:N/AC:L/PR:N/UI:N) with high impact across C/I/A, yielding a 9.8 Critical score, which on paper is patch-immediately priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network reachability to an exposed IOS XE service sends crafted input containing unneutralized special elements that the device passes to a vulnerable parser or command context, achieving code execution or configuration compromise without credentials or user interaction. Given AV:N/AC:L/PR:N/UI:N, a single crafted request could suffice; however, no public POC or exploit code has been identified, so real-world exploitation currently depends on an attacker independently developing the exploit against a reachable vulnerable interface. |
| Remediation | Upgrade to a fixed Cisco IOS XE hardening release as specified in Cisco advisory cisco-sa-hardening-iosxe-V8NMuMZJ (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ); use the Cisco Software Checker / advisory fixed-release table to map your exact running train to its patched build, since the advisory bundles multiple internally found issues and the exact fix version was not provided in this dataset. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct an urgent inventory of all Cisco IOS XE devices in your network and implement network segmentation to restrict remote access to affected systems from untrusted networks and external sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Ios Xe Software
View allAuthentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to g
Denial-of-service via malformed XMCP packets forces unexpected reloads of Cisco IOS and IOS XE devices, exploitable by a
Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticate
Unauthenticated remote denial-of-service affecting Cisco IOS XE Software across a wide version range results from multip
Unauthenticated remote denial-of-service in Cisco IOS XE Software allows network-accessible attackers to crash IOS proce
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discovera
Unauthenticated remote attackers can cause high availability impact with scope change on Cisco IOS XE Software through i
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a com
Denial of service in Cisco IOS XE Software's SNMP subsystem allows an authenticated remote attacker to force an affected
Denial of service in Cisco IOS XE Software's web-based management interface allows an authenticated remote attacker with
Denial-of-service in Cisco IOS XE Software's web-based management interface (WebUI) allows an authenticated remote attac
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today