EUVD-2026-70203
GHSA-gg8h-54f3-9xqm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Network-reachable, no authentication, scope change matches IOS XR process architecture; availability-only impact with no confidentiality or integrity effect.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
4DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20276 are related to insufficient control flow management issues that are grouped under the Common Weakness Enumeration (CWE) CWE-691.
AnalysisAI
Remote unauthenticated denial-of-service conditions in Cisco IOS XR Software stem from multiple insufficient control flow management flaws (CWE-691) discovered during an internal Cisco security hardening review. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) indicates network-accessible, zero-friction exploitation with scope change, meaning the availability impact can propagate beyond the directly targeted device to affect connected or dependent network infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N) - remote unauthenticated exploitation against network-reachable Cisco IOS XR devices in default configurations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.6 score and its underlying vector (AV:N/AC:L/PR:N/UI:N/S:C/A:H) represent a credible high-severity threat: exploitation requires no authentication, no user interaction, and no unusual network positioning, meaning any network path to an exposed Cisco IOS XR service is sufficient. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the Cisco IOS XR hardened software release identified in the vendor advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM; exact fixed version numbers must be confirmed from that advisory as they vary by platform and release train. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cisco IOS XR devices in your environment and identify currently deployed software versions; simultaneously contact Cisco for available hardening builds addressing these vulnerabilities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Ios Xr Software
View allImproper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restric
Improper resource lifecycle control (CWE-664) in Cisco IOS XR Software is addressed by a batch software-hardening releas
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privile
Improper handling of exceptional conditions (CWE-703) in Cisco IOS XR Software allows an authenticated, remote attacker
Incorrect calculation vulnerabilities (CWE-682) in Cisco IOS XR Software allow an unauthenticated attacker on an adjacen
Protection mechanism failures in Cisco IOS XR Software allow remote unauthenticated attackers to achieve high availabili
Same weakness CWE-691 – Insufficient Control Flow Management
View allShare
External POC / Exploit Code
Leaving vuln.today