Cisco IOS XR CVE-2026-76505

Exploitation requires the target to be an ASR 9000 or 9900 Series or ASR 9902/9903 Compact router running Cisco IOS XR, and the crafted IPv4 packets must be received on an affected line card interface and processed as for-us traffic (destined to the device itself/control plane). Limiting factors that reduce real-world exposure: transit IPv4 traffic does NOT trigger the flaw and IPv6 traffic CANNOT trigger it, so the attacker must be able to reach a router-addressed IPv4 interface; persistent NP shutdown (requiring manual line card reload) only occurs under repeated reset conditions, whereas single events cause transient recovery. No authentication or user interaction is required (PR:N/UI:N).

This is a genuine availability-focused DoS affecting carrier-grade routing hardware, but not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) indicates remote, unauthenticated, low-complexity exploitation with no user interaction - the worst-case reachability profile - but impact is confined to availability (C:N/I:N), so there is no data compromise or code execution. No EPSS score, CISA KEV entry, POC reference, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified from the available signals; the only exploitation evidence is the vendor advisory itself. The practical risk is tempered by the requirement that malicious IPv4 packets be processed as 'for-us' traffic (destined to the device control plane) on an affected line card - transit IPv4 and all IPv6 traffic are explicitly non-triggering - which narrows the realistic attack surface to the router's own addressed interfaces. Overall: a credible, patch-worthy control-plane DoS for operators of the named ASR 9000/9900/9902/9903 platforms, but currently no public exploit identified and no evidence of active exploitation.

A remote, unauthenticated attacker sends specially crafted IPv4 packets addressed to an affected ASR 9000/9900/9902/9903 line card interface so they are handled as for-us (control-plane) traffic. The malformed packets trigger a network processor error, causing the line card to reset and drop traffic while it recovers; repeated packets can drive the NP into a persistent shutdown requiring a manual line card reload. No public exploit code is identified at time of analysis.