EUVD-2026-15431
GHSA-m8vf-g949-jwr2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted BOOTP request packets
-
ExploitDHCP snooping fails to validate VLAN boundaries
-
ExecutionBOOTP packets forwarded between VLANs
-
ImpactHigh CPU utilization causes denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | DHCP snooping feature must be enabled on Cisco Catalyst 9000 Series Switches running affected IOS XE versions. Unauthenticated remote attacker sends BOOTP request packets to trigger VLAN leakage and denial of service. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) indicates this is a remotely exploitable vulnerability with low attack complexity requiring no authentication, changed scope, and high availability impact, justifying the 8.6 score. However, real-world risk is moderated by several factors: the vulnerability requires DHCP snooping to be actively configured (not default on all deployments), Cisco has published workarounds, and there is no evidence of public POC code or active exploitation. The vulnerability is exploitable from the network and could be automated by scanning for devices with DHCP snooping enabled and sending malformed BOOTP packets. For organizations using Catalyst 9000 switches with DHCP snooping in multi-tenant or security-sensitive VLAN architectures, this represents a genuine risk due to the VLAN isolation bypass and DoS potential. The availability of workarounds and lack of KEV listing suggest this is a priority for affected organizations but not an immediate crisis requiring emergency patching across all environments. |
| Exploit ScenarioDerived | An attacker on any network segment that can reach a Cisco Catalyst 9000 switch with DHCP snooping enabled sends crafted BOOTP request packets (either unicast or broadcast) to the device. These malformed packets bypass VLAN isolation controls and are forwarded to other VLANs while consuming excessive CPU resources. As the attack continues, the switch's CPU utilization reaches critical levels, rendering the device unresponsive to console and remote management access and unable to forward legitimate network traffic, resulting in a complete denial of service for all connected users and systems. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
Improper BOOTP packet handling in Cisco IOS XE Software on Catalyst 9000 Series Switches allows unauthenticated remote attackers to trigger VLAN leakage and cause device unavailability through resource exhaustion. An attacker can send crafted BOOTP requests to forward packets across VLANs, leading to high CPU utilization that renders the switch unreachable and unable to process traffic. No patch is currently available for this denial-of-service vulnerability.
Earlier versions of this analysis (1)
A vulnerability in the DHCP snooping feature of Cisco IOS XE Software allows unauthenticated remote attackers to cause denial of service by forwarding BOOTP packets across VLANs on Cisco Catalyst 9000 Series Switches. Successful exploitation leads to VLAN isolation bypass, high CPU utilization, and complete device unavailability for management and traffic forwarding. There is no evidence of active exploitation (not in KEV), but the vulnerability has a high CVSS score of 8.6 and affects a widely deployed enterprise switching platform.
RemediationAI
Upgrade to a fixed version of Cisco IOS XE Software as specified in the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bootp-WuBhNBxA. Cisco indicates that workarounds are available to address this vulnerability, which likely involve modifying DHCP snooping configurations or implementing access control lists to filter BOOTP traffic at VLAN boundaries. Until patching is feasible, consult the advisory for specific workaround procedures, consider disabling DHCP snooping on non-critical VLANs if operationally acceptable, and implement network segmentation and rate-limiting on BOOTP/DHCP traffic to reduce attack surface. Monitor CPU utilization on affected switches for anomalous spikes that may indicate exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects Cisco IOS XE Software running on Catalyst 9000 Series Switches, specifically the DHCP snooping security feature designed to filter untrusted DHCP messages and build a binding database. The affected product is identified by CPE cpe:2.3:a:cisco:cisco_ios_xe_software:*:*:*:*:*:*:*:*. The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), where improper handling of BOOTP packets (the predecessor protocol to DHCP operating on UDP ports 67/68) causes resource exhaustion. When DHCP snooping is enabled, the switch should enforce VLAN boundaries for DHCP/BOOTP traffic, but the vulnerability allows specially crafted BOOTP request packets (either unicast or broadcast) to leak between VLANs and consume excessive CPU resources. Over 100 specific versions ranging from 16.6.x through 17.18.x are confirmed vulnerable according to ENISA EUVD-2026-15431.
Know when Cisco Ios Xe Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packets to be forwarded between VLANs, resulting in a denial of service (DoS) condition. This vulnerability is due to improper handling of BOOTP packets on Cisco Catalyst 9000 Series Switches. An attacker could exploit this vulnerability by sending BOOTP request packets to an affected device. A successful exploit could allow an attacker to forward BOOTP packets from one VLAN to another, resulting in BOOTP VLAN leakage and potentially leading to high CPU utilization. This makes the device unreachable (either through console or remote management) and unable to forward traffic, resulting in a DoS condition. Note: This vulnerability can be exploited with either unicast or broadcast BOOTP packets. There are workarounds that address this vulnerability.
Executive ViewAI
Cisco Catalyst 9000 Series Switches are vulnerable to a denial-of-service attack that could render network infrastructure unavailable, disrupting business operations across all dependent systems. Without an available patch, organizations must implement immediate network controls to restrict BOOTP traffic and monitor for exploitation attempts targeting this critical switching platform.
Disable DHCP snooping on VLANs where it is not operationally required; implement strict BOOTP packet rate-limiting and filtering at network ingress points; configure Access Control Lists (ACLs) to block BOOTP traffic (UDP port 67/68) across VLAN boundaries; enable comprehensive DHCP snooping logging and alerts for abnormal packet patterns; segment critical network functions onto separate switch instances where feasible; deploy out-of-band management access to switches to maintain management capability during potential DoS events; establish continuous CPU and memory utilization monitoring with automatic failover to standby devices if thresholds are exceeded.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Cisco Ios Xe Software
View allImproper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthentic
Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to g
Denial-of-service via malformed XMCP packets forces unexpected reloads of Cisco IOS and IOS XE devices, exploitable by a
Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticate
Unauthenticated remote denial-of-service affecting Cisco IOS XE Software across a wide version range results from multip
Unauthenticated remote denial-of-service in Cisco IOS XE Software allows network-accessible attackers to crash IOS proce
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discovera
Unauthenticated remote attackers can cause high availability impact with scope change on Cisco IOS XE Software through i
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a com
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Denial of service in Cisco IOS XE Software's SNMP subsystem allows an authenticated remote attacker to force an affected
Memory exhaustion in Cisco IOS XE and Apple devices via improper TLS resource handling allows adjacent attackers to trig
Exploit-DB