EUVD-2026-70203
GHSA-gg8h-54f3-9xqm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed IOS XR service over network
-
DeliverySend crafted malformed request
-
ExploitTrigger control-flow defect (CWE-691)
-
ExecutionCrash process or force device reload
-
ImpactDenial of service / routing disruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Insufficient control flow management
|
| Exploitation Conditions | The generic advisory does not name the specific vulnerable feature, protocol, or configuration, so the exact trigger surface is undisclosed; per CVSS AV:N/AC:L/PR:N/UI:N it is characterized as remotely reachable without authentication or user interaction against affected IOS XR releases, but confirmation of which service must be enabled/exposed requires the Cisco advisory. Limiting factors: impact is availability-only (device crash/reload, no data compromise), only Cisco IOS XR-based platforms (e.g., ASR 9000/NCS/CRS-class routers) are affected, exploitation requires network reachability to the vulnerable service, and no public exploit exists - reducing realistic near-term risk despite the network vector. |
| Impact | This is a moderate-priority availability issue, not a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) describes a remotely reachable, unauthenticated, low-complexity flaw with pure denial-of-service impact (A:H) and no confidentiality or integrity loss - consistent with CWE-691 insufficient control flow management causing a crash/reload. Multiple weaker signals argue against urgency: EPSS is only 0.25% (16th percentile), there is no CISA KEV listing, no public POC, and CISA SSVC records Exploitation=none. Notably, SSVC lists Automatable=yes and Technical Impact=partial, meaning that IF an exploit emerged it could be scripted at scale, but the 'none' exploitation status and low EPSS indicate no current activity. The vulnerability was internally discovered by Cisco's own engineering review rather than found in the wild, further lowering near-term risk. One caveat: the CVE description is a generic hardening-bundle placeholder that does not specify the affected protocol, service, or feature, so the precise remote-reachability conditions cannot be independently confirmed from the description alone - the CVSS AV:N should be verified against Cisco advisory cisco-sa-hardening-iosxr-qg64NcM. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted traffic to a network-reachable service on a Cisco IOS XR router, triggering the control-flow defect and causing a process crash or device reload that disrupts routing. No public exploit code has been identified, and the specific triggering vector is not disclosed in the generic advisory text. Repeated triggering could sustain an outage on carrier or backbone infrastructure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 17, 2026
Insufficient control flow management weaknesses (CWE-691) in Cisco IOS XR Software allow unauthenticated remote attackers to cause a denial of service - service disruption leading to a device crash or reload - on affected routers and switch platforms. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) the issue is remotely reachable without authentication or user interaction, but there is no integrity or confidentiality impact, and the specific vulnerable feature or service is not named in the generic hardening advisory. Risk is currently moderate rather than critical: no public exploit has been identified at time of analysis, CISA SSVC records Exploitation as 'none' (Automatable: yes, Technical Impact: partial), and EPSS is only 0.25% (16th percentile), so near-term exploitation likelihood is low. Cisco addressed these internally discovered issues through scheduled IOS XR software hardening releases rather than in response to observed attacks.
Earlier versions of this analysis (1)
Remote unauthenticated denial-of-service conditions in Cisco IOS XR Software stem from multiple insufficient control flow management flaws (CWE-691) discovered during an internal Cisco security hardening review. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) indicates network-accessible, zero-friction exploitation with scope change, meaning the availability impact can propagate beyond the directly targeted device to affect connected or dependent network infrastructure. No active exploitation has been identified and no public proof-of-concept exists at time of analysis; Cisco has proactively released software hardening builds addressing these issues.
RemediationAI
Cisco has published a hardening advisory covering these internally discovered issues (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM); patch availability is confirmed per vendor advisory, but no single exact fixed version is specified in the available data, so administrators must consult that advisory's per-release table to identify the corrected IOS XR build for each deployed train and upgrade during a standard maintenance window - an IOS XR upgrade is service-affecting and requires a planned reload, so schedule accordingly. Where the upgrade cannot be performed immediately, reduce exposure with controls that match the availability-only, network-reachable nature of the flaw: apply infrastructure ACLs (iACL) and control-plane policing (CoPP) so that only trusted management/peer address space can reach router control-plane services, and disable or filter any unused management or routing-plane services (for example, disable the HTTP/HTTPS server, restrict SSH/SNMP/TACACS+ to a management VRF or jump hosts, and disable unused routing protocol adjacencies). The trade-off is that aggressive control-plane filtering can drop legitimate BGP/IGP sessions or management traffic, so stage policies in monitor mode and validate before enforcement; a management-VRF plus iACL combination is generally the lowest-risk interim measure. Monitor for unexplained process restarts, reloads, or line-card resets on router hardware as an indicator that the weakness is being triggered, and coordinate with Cisco TAC (or your account team under a support contract) for release-specific guidance and interim SMUs where the advisory indicates they exist.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-691 (Insufficient Control Flow Management) is a meta-level weakness class covering flawed branching, sequencing, or state-machine logic in code that can leave execution in an unexpected path - in a network operating system this typically manifests as resource exhaustion, an unexpected process restart, or a control-plane crash rather than memory corruption exploitable for code execution. The affected CPE, cpe:2.3:a:cisco:cisco_ios_xr_software:*:*:*:*:*:*:*:*, uses a wildcard version, confirming that the hardening fixes span the entire IOS XR release train rather than a single build; ENISA EUVD enumerates affected builds from the legacy 6.5.x/6.7.x/6.9.x lines through 7.x (up to 7.11.x) and modern 24.x/25.x/26.x releases. Cisco states the findings came from an internal proactive security review, and multiple CVEs were grouped under this single hardening advisory, which is why the description is deliberately generic and does not disclose the specific vulnerable feature, protocol, or configuration. The impact is availability-only, so exploitation degrades routing/forwarding availability (potential route churn, session resets, or line-card/reload events) rather than exposing configuration or credentials.
Know when Cisco Ios Xr Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Remotely reachable, low-complexity, unauthenticated control-flow defect producing device crash/reload; availability-only impact with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20276 are related to insufficient control flow management issues that are grouped under the Common Weakness Enumeration (CWE) CWE-691.
Executive ViewAI
A high-severity flaw in Cisco IOS XR Software, the operating system running many of the organization's core routers and switches, lets any unauthenticated attacker who can reach the device over the network force a crash or reload, taking that network segment offline. Because no credentials or user interaction are required and there is currently no vendor patch, the exposure rests on how well the network control and management planes are defended and how fast affected devices can be isolated or recovered. Leadership should care because the impact is concentrated on availability of critical network infrastructure rather than on data confidentiality or integrity.
No vendor-released patch is available; interim mitigations are network-access restrictions (infrastructure ACLs and control plane policing) to limit which sources can reach IOS XR devices, disabling unused services and protocols per Cisco IOS XR hardening guidance, segmenting or isolating high-risk routers and switches from untrusted networks, ensuring out-of-band management and tested recovery procedures for a crash or reload, and continuous monitoring of device reload/crash telemetry to detect exploitation attempts early.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Cisco Ios Xr Software
View allImproper resource lifecycle control (CWE-664) in Cisco IOS XR Software is addressed by a batch software-hardening releas
Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restric
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privile
Improper handling of exceptional conditions (CWE-703) in Cisco IOS XR Software allows an authenticated, remote attacker
Incorrect calculation vulnerabilities (CWE-682) in Cisco IOS XR Software allow an unauthenticated attacker on an adjacen
Protection mechanism failures in Cisco IOS XR Software allow remote unauthenticated attackers to achieve high availabili
Crafted IPv4 packets addressed to the router itself can drive the line card network processor on Cisco IOS XR into repea
Exploit-DB