EUVD-2026-15426
GHSA-xp4f-63f5-wmm9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish adjacent network access to device
-
DeliveryTrigger repeated TLS connection setup
-
ExploitCause memory leak in TLS library
-
ExecutionExhaust device memory resources
-
ImpactCause denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Resource allocation tracking
|
| Exploitation Conditions | Requires local EAP (Extensible Authentication Protocol) to be enabled on Cisco IOS XE Software. Attacker must be adjacent on the network and repeatedly trigger TLS connection setup or EAP authentication attempts to exhaust device memory. No authentication required. |
| Impact | The CVSS score of 7.4 (High) reflects significant impact with CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, indicating an adjacent network attack vector with low complexity, no privileges required, and high availability impact with scope change. However, the real-world risk is moderated by the adjacent network requirement (AV:A), meaning attackers must be on the same network segment as the vulnerable device, limiting exposure compared to remotely exploitable vulnerabilities. The vulnerability is tagged for Denial of Service impact with no data confidentiality or integrity compromise. No KEV (Known Exploited Vulnerability) listing exists, suggesting no confirmed active exploitation in the wild. The extensive list of 194 affected versions (ranging from 16.9.1 through 17.16.1a) indicates widespread potential exposure across Cisco enterprise networks. The attack requires sustained network adjacency to repeatedly trigger TLS connection setups, making it less automatable than remote exploits but still practical for insider threats or compromised adjacent systems. Priority should be high for internet-facing or critical infrastructure devices, moderate for internally segmented networks with strong access controls. |
| Exploit ScenarioDerived | An attacker with access to an adjacent network segment (such as a compromised endpoint, rogue access point, or malicious insider on the same VLAN) repeatedly initiates TLS connections to a vulnerable Cisco IOS XE device. The attacker uses a script to continuously trigger EAP authentication attempts or performs a machine-in-the-middle attack using ARP spoofing to intercept and reset TLS connections between the target device and legitimate network peers. Over time, the memory leak from improperly released TLS connection resources exhausts available memory, causing the device to reload unexpectedly and creating a sustained denial of service condition that disrupts network operations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
Memory exhaustion in Cisco IOS XE and Apple devices via improper TLS resource handling allows adjacent attackers to trigger denial of service by repeatedly initiating failed authentication or manipulating TLS connections. An unauthenticated attacker can exploit this by resetting TLS sessions or abusing EAP authentication mechanisms to deplete device memory without requiring network access from the internet. Successful exploitation renders affected devices unresponsive, with no patch currently available.
Earlier versions of this analysis (1)
A memory exhaustion vulnerability exists in the TLS library of Cisco IOS XE Software that allows an unauthenticated, adjacent attacker to trigger a denial of service condition. Affected devices include over 190 versions of Cisco IOS XE Software running on network infrastructure equipment. Attackers can exploit this by repeatedly triggering TLS connection setup conditions through methods like repeated EAP authentication attempts or machine-in-the-middle attacks that reset TLS connections, ultimately causing device reload.
RemediationAI
Upgrade to a fixed version of Cisco IOS XE Software as specified in the vendor security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-tls-dos-TVgLDEZL. Cisco typically provides fixed releases for actively supported version trains, so consult the advisory for the appropriate upgrade path based on your current version. As an interim mitigation until patching is feasible, disable local EAP authentication if not required for operations, implement network access controls to restrict adjacent network access to trusted devices only, and deploy monitoring for abnormal memory consumption patterns on affected devices. Consider segmenting critical network infrastructure to limit adjacent network attack surface. For devices where TLS connections can be controlled, implement rate limiting or connection throttling at upstream network security devices to reduce the effectiveness of repeated connection attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the TLS library implementation in Cisco IOS XE Software (cpe:2.3:a:cisco:cisco_ios_xe_software), which is the operating system running on Cisco enterprise routers and switches. The root cause is classified as CWE-771 (Missing Reference to Active Allocated Resource), indicating improper memory resource management during TLS connection setup and teardown. The vulnerability manifests when TLS handshakes are initiated but not properly completed, causing memory allocations that are never released. This can be triggered through various TLS-dependent features including Extensible Authentication Protocol (EAP) local authentication and standard TLS connections between devices. The memory leak compounds with each aborted or reset TLS connection until available memory is exhausted.
Know when Cisco Ios Xe Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the TLS library of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust the available memory of an affected device. This vulnerability is due to improper management of memory resources during TLS connection setup. An attacker could exploit this vulnerability by repeatedly triggering the conditions that cause the memory increase. This could be done in a variety of ways, such as by repeatedly attempting Extensible Authentication Protocol (EAP) authentication when local EAP is enabled on an affected device or by using a machine-in-the-middle attack and resetting TLS connections between the affected device and other devices. A successful exploit could allow the attacker to exhaust the available memory on an affected device, resulting in an unexpected reload and a denial of service (DoS) condition.
Executive ViewAI
Cisco IOS XE devices across our network infrastructure face a denial of service vulnerability with no available patch, exposing us to potential service disruptions from adjacent network attackers. This affects over 190 software versions and could force device reloads, impacting network availability and business operations.
Implement network access controls and 802.1X port security to limit adjacent network access; disable EAP on untrusted interfaces; enforce strict TLS connection rate limiting on affected devices; segment network to isolate infrastructure equipment from untrusted adjacent networks; enable device logging and alerts for abnormal TLS connection patterns; consider temporary disabling of wireless access points using vulnerable IOS XE versions until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Cisco Ios Xe Software
View allImproper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthentic
Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to g
Denial-of-service via malformed XMCP packets forces unexpected reloads of Cisco IOS and IOS XE devices, exploitable by a
Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticate
Unauthenticated remote denial-of-service affecting Cisco IOS XE Software across a wide version range results from multip
Unauthenticated remote denial-of-service in Cisco IOS XE Software allows network-accessible attackers to crash IOS proce
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discovera
Unauthenticated remote attackers can cause high availability impact with scope change on Cisco IOS XE Software through i
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a com
Improper BOOTP packet handling in Cisco IOS XE Software on Catalyst 9000 Series Switches allows unauthenticated remote a
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Denial of service in Cisco IOS XE Software's SNMP subsystem allows an authenticated remote attacker to force an affected
Exploit-DB