EUVD-2026-70206
GHSA-ff4v-8pj2-jrwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed IOS XR service over network
-
DeliverySend crafted request exploiting access-control flaw
-
ExploitBypass authorization checks
-
ExecutionGain privileged device control
-
ImpactAlter routing / intercept / disrupt traffic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with no user interaction against affected Cisco IOS XR versions, but the vendor description provides NO concrete prerequisite - it does not name the specific feature, protocol, service, or interface that must be reachable, nor whether the vulnerable component is enabled/exposed by default. Realistic exploitation is therefore gated by network reachability to whatever IOS XR service carries the flaw: if that service lives on the management plane, exploitation is limited to attackers who can reach management interfaces (mitigable via MPP/iACLs/out-of-band VRF); if it is a control-plane or peering service, exposure is broader. This ambiguity is a genuine data gap - verify the affected service and its default exposure against the Cisco advisory before assuming default-configuration internet exploitability. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8 and paints a maximal-severity picture: network-reachable, low complexity, no privileges or user interaction, with total confidentiality, integrity and availability impact. However, several strong exploitation signals are ABSENT: this is not in CISA KEV (no confirmed active exploitation), no public POC is referenced, and no EPSS score was supplied - so real-world exploitation pressure is currently low. Importantly, the description is generic hardening-advisory boilerplate that provides zero technical specifics, so the 9.8 cannot be independently corroborated and rests entirely on Cisco's self-assessment; the true attack surface (which feature/protocol/interface, whether the affected service is exposed by default or only on the management plane) is unverifiable from the provided data. Net: treat as a high-priority patch for internet- or peer-exposed IOS XR devices given the vendor's critical rating, but recognize the risk is vendor-asserted rather than demonstrated. Note the loose 'Authentication Bypass' tag aligns with CWE-284 but is not independently confirmed. |
| Exploit ScenarioDerived | An attacker with network reachability to an affected IOS XR router's exposed service sends crafted requests that exploit the access-control flaw to bypass authorization, gaining privileged control over the device without credentials or user interaction. From there they could alter routing configuration, intercept or disrupt traffic, or take the router offline. No public exploit code is currently known, so real-world exploitation would require the attacker to independently develop the technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restrictions and gain full compromise of affected routing platforms, per Cisco's CVSS 9.8 rating. The flaw is one of several internally discovered issues addressed in a batch of software-hardening releases from Cisco's proactive security review (advisory cisco-sa-hardening-iosxr-qg64NcM). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-supplied description is high-level boilerplate with no concrete technical detail.
RemediationAI
Apply the fixed IOS XR software-hardening release referenced in Cisco advisory cisco-sa-hardening-iosxr-qg64NcM (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM); the exact fixed version was not included in the provided input, so identify your platform's specific patched train from the advisory's fixed-release table before upgrading (Patch available per vendor advisory). Because the vulnerable component is not specified, apply general IOS XR management-plane hardening as compensating controls until patched: restrict access to management and control-plane services using Management Plane Protection (MPP) and infrastructure ACLs to trusted subnets, apply Control Plane Policing (CoPP) / Local Packet Transport Services (LPTS) rate and access limits, and place management interfaces in an isolated out-of-band VRF - trade-off is these do not fix an authorization bypass reachable via a legitimately exposed data/peer path and may complicate remote operations. Prioritize devices with management or peering interfaces exposed to untrusted networks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco IOS XR is the microkernel-based, Linux-derived network operating system that runs Cisco's high-end carrier and service-provider routing platforms (ASR 9000 series, NCS series, CRS). The CPE cpe:2.3:a:cisco:cisco_ios_xr_software:*:*:*:*:*:*:*:* covers the software broadly across all versions, with no version boundary provided. The root cause is classified as CWE-284 (Improper Access Control), a class in which the software fails to correctly restrict which actors can perform an operation or reach a resource - here plausibly manifesting as an authorization/authentication-bypass path in a management or control-plane component. Cisco states these were found through an internal security review rather than field exploitation.
Know when Cisco Ios Xr Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adopts Cisco's vector for an unauthenticated network access-control bypass yielding full device compromise; retained but low-confidence because the boilerplate description offers no detail to independently confirm the metrics.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20279 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.
Executive ViewAI
Cisco IOS XR Software contains an unauthenticated remote access control flaw (CVSS 9.8) that allows attackers to bypass authorization and compromise routing platforms critical to enterprise and service provider networks. This affects all organizations running IOS XR and requires immediate mitigation, as no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) strict network segmentation restricting management plane access to authorized administrator subnets via ACLs; (2) SSH key-based authentication enforcement with password-based access disabled; (3) VPN or out-of-band management requirement for all remote access; (4) continuous monitoring and alerting on management interface access anomalies. Engage Cisco TAC immediately to determine if advisory-specific workarounds exist for your version.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Cisco Ios Xr Software
View allImproper resource lifecycle control (CWE-664) in Cisco IOS XR Software is addressed by a batch software-hardening releas
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privile
Improper handling of exceptional conditions (CWE-703) in Cisco IOS XR Software allows an authenticated, remote attacker
Incorrect calculation vulnerabilities (CWE-682) in Cisco IOS XR Software allow an unauthenticated attacker on an adjacen
Insufficient control flow management weaknesses (CWE-691) in Cisco IOS XR Software allow unauthenticated remote attacker
Protection mechanism failures in Cisco IOS XR Software allow remote unauthenticated attackers to achieve high availabili
Crafted IPv4 packets addressed to the router itself can drive the line card network processor on Cisco IOS XR into repea
Exploit-DB