What is the CVSS score of CVE-2026-20279?

CVE-2026-20279 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Cisco IOS XR are affected by CVE-2026-20279?

Cisco IOS XR Software contains an unauthenticated remote access control flaw (CVSS 9.8) that allows attackers to bypass authorization and compromise routing platforms critical to enterprise and…

How to fix or mitigate CVE-2026-20279?

Within 24 hours: identify all Cisco IOS XR deployments and document affected versions against Cisco advisory cisco-sa-hardening-iosxr-qg64NcM. Within 7 days: implement network segmentation to restrict management plane access using ACLs, enforce SSH key-based authentication, and require VPN for remote access; while no public exploit identified at time of analysis, this vulnerability's severity warrants immediate defensive implementation. Within 30 days: coordinate with Cisco TAC for expedited patch availability, develop a replacement or upgrade plan for extended out-of-support versions, and validate compensating controls through security assessment.

Cisco IOS XR CVE-2026-20279

EUVD-2026-70206 CRITICAL

Improper Access Control (CWE-284)

2026-09-02 cisco

GHSA-ff4v-8pj2-jrwh

Authentication Bypass Cisco Cisco Ios Xr Software

9.8

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Adopts Cisco's vector for an unauthenticated network access-control bypass yielding full device compromise; retained but low-confidence because the boilerplate description offers no detail to independently confirm the metrics.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 02, 2026 - 17:40 vuln.today

tag: Apple removed

Analysis Generated

Sep 02, 2026 - 17:03 vuln.today

CVE Published

Sep 02, 2026 - 16:13 cve.org

CRITICAL 9.8

DescriptionCVE.org

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20279 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.

AnalysisAI

Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restrictions and gain full compromise of affected routing platforms, per Cisco's CVSS 9.8 rating. The flaw is one of several internally discovered issues addressed in a batch of software-hardening releases from Cisco's proactive security review (advisory cisco-sa-hardening-iosxr-qg64NcM). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with no user interaction against affected Cisco IOS XR versions, but the vendor description provides NO concrete prerequisite - it does not name the specific feature, protocol, service, or interface that must be reachable, nor whether the vulnerable component is enabled/exposed by default. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8 and paints a maximal-severity picture: network-reachable, low complexity, no privileges or user interaction, with total confidentiality, integrity and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the fixed IOS XR software-hardening release referenced in Cisco advisory cisco-sa-hardening-iosxr-qg64NcM (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM); the exact fixed version was not included in the provided input, so identify your platform's specific patched train from the advisory's fixed-release table before upgrading (Patch available per vendor advisory). … Detailed patch versions, workarounds, and compensating controls in full report.