EUVD-2026-70204
GHSA-3m84-xhjg-xc55
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IOS XR service over network
-
DeliverySend crafted protocol traffic
-
ExploitTrigger CWE-664 resource mishandling
-
ExecutionCorrupt router state or memory
-
PersistAchieve code execution or crash
-
ImpactCompromise routing/availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource lifecycle control
|
| Exploitation Conditions | Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires only network reachability to the affected IOS XR service with no authentication and no user interaction against a router running a vulnerable, unpatched IOS XR train. The precise limiting factors - which daemon, protocol port, or feature must be enabled/configured to expose the flaw - are NOT disclosed in this batch advisory, so the practical prerequisites cannot be confirmed from available data; the realistic constraint is that an attacker must be able to reach the vulnerable component, which management-plane and control-plane access controls (iACL/CoPP) may already limit in hardened deployments. |
| Impact | The raw signals are severe: CVSS 9.8 with a network attack vector, low complexity, no privileges, and no user interaction, plus full C/I/A impact, which on paper describes a wormable-grade unauthenticated remote flaw on carrier-class routers. However, the description is a generic batch-hardening notice with zero technical detail, no EPSS probability, no KEV listing, and no confirmed proof-of-concept, so the 9.8 should be treated as a conservative vendor upper-bound rather than a validated exploit path. This is a genuine patch-now item for any organization running IOS XR on internet- or peering-facing routers, and even a mid-sized municipal network operator in legnica should treat a 9.8 on core routing infrastructure as urgent - but the absence of exploitation evidence and technical specifics means it is currently a high-severity-but-unproven risk, not confirmed active exploitation. The tag set ("Apple", "Information Disclosure") is inconsistent with a Cisco IOS XR full-impact flaw and should not drive triage. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to a vulnerable IOS XR router sends crafted traffic to the affected service, triggering the resource-control flaw to corrupt device state and gain code execution or crash the router. Given the network/no-auth CVSS profile, this could be launched from a peering or transit network segment; no public proof-of-concept is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Improper resource lifecycle control (CWE-664) in Cisco IOS XR Software is addressed by a batch software-hardening release stemming from Cisco's internal security review (advisory cisco-sa-hardening-iosxr-qg64NcM). The provided CVSS vector (AV:N/AC:L/PR:N/UI:N, 9.8) implies a remotely reachable, unauthenticated flaw with high confidentiality, integrity, and availability impact on IOS XR routers, but Cisco's omnibus advisory publishes no technical specifics on the affected component or trigger. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied.
RemediationAI
Patch available per vendor advisory: apply the Cisco IOS XR software-hardening release referenced in cisco-sa-hardening-iosxr-qg64NcM (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM); consult that advisory's Fixed Software section for the exact target train for your platform, as no explicit fix version is included in the CVE record. Until upgraded, apply standard IOS XR management-plane hardening as compensating controls: restrict management and routing-protocol reachability with infrastructure ACLs (iACLs) and Control Plane Policing (CoPP/LPTS) so untrusted networks cannot reach exposed services, and confine device management to a dedicated out-of-band or VRF-isolated management network - noting these controls reduce exposure but cannot substitute for the fix if the vulnerable component is a data- or control-plane protocol that must remain reachable. Because the specific vulnerable service is undisclosed, prioritize the software upgrade over relying on filters alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco IOS XR is the microkernel/Linux-based network operating system running on Cisco's high-end service-provider and core routing platforms (e.g., ASR 9000, NCS 5500/5000, CRS families), identified here by cpe:2.3:a:cisco:cisco_ios_xr_software:*. CWE-664 (Improper Control of a Resource Through Its Lifetime) is a broad parent class covering mishandling of a resource (memory, file descriptors, sessions, buffers, or state) across acquisition, use, and release - encompassing use-after-free, uninitialized/leaked resources, and premature release. Because this is a grouped internal-hardening disclosure rather than a single externally-reported bug, the specific resource, protocol, or daemon involved is not named in the CVE record.
Know when Cisco Ios Xr Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adopts the vendor network/unauthenticated full-impact profile as a best estimate, but the batch advisory lacks technical detail to independently confirm AV, AC, or PR, so confidence is low.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20274 are related to improper resource control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-664.
Executive ViewAI
Cisco IOS XR Software contains a critical improper resource lifecycle control vulnerability (CVSS 9.8) remotely reachable without authentication, affecting confidentiality, integrity, and availability of network infrastructure. All IOS XR router deployments are at immediate risk; no vendor patch is currently available, and interim protections must be deployed within 24 hours.
Apply Cisco's batch software-hardening release (advisory cisco-sa-hardening-iosxr-qg64NcM); implement network segmentation and strict access controls to restrict unauthenticated network access to IOS XR systems; enable detailed syslog monitoring for unusual resource utilization or system behavior changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Cisco Ios Xr Software
View allImproper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restric
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privile
Improper handling of exceptional conditions (CWE-703) in Cisco IOS XR Software allows an authenticated, remote attacker
Incorrect calculation vulnerabilities (CWE-682) in Cisco IOS XR Software allow an unauthenticated attacker on an adjacen
Insufficient control flow management weaknesses (CWE-691) in Cisco IOS XR Software allow unauthenticated remote attacker
Protection mechanism failures in Cisco IOS XR Software allow remote unauthenticated attackers to achieve high availabili
Crafted IPv4 packets addressed to the router itself can drive the line card network processor on Cisco IOS XR into repea
Exploit-DB