What is the CVSS score of EUVD-2026-53452?

EUVD-2026-53452 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Cisco IOS XE are affected by EUVD-2026-53452?

Cisco IOS XE BEEP feature (CVE-2026-20263) contains a denial-of-service vulnerability allowing unauthenticated remote attackers to force device reloads that cascade to all downstream network…

How to fix or mitigate EUVD-2026-53452?

Within 24 hours: Inventory all Cisco IOS XE devices with BEEP enabled and determine internet/network exposure; disable BEEP via configuration where operationally feasible. Within 7 days: Deploy network access controls (ACLs on routers and firewalls) to restrict BEEP traffic (TCP port 10288) to trusted internal sources only, or block entirely if the feature is not business-critical. Within 30 days: Implement monitoring for unexpected device reloads and BEEP anomalies; contact Cisco TAC for interim workarounds and patch availability timeline; evaluate firmware upgrade paths to versions addressing this CVE if available.

Cisco IOS XE EUVD-2026-53452

| CVE-2026-20263 HIGH

7PK - Errors (CWE-388)

2026-08-05 cisco

GHSA-wrfp-gcwf-q2vv

Denial Of Service Apple Microsoft Cisco Cisco Ios Xe Software

8.6

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

8.6 HIGH

Network-accessible unauthenticated parse flaw with no special conditions; Changed scope reflects device reload cascading availability loss to all downstream network-dependent systems.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:30 vuln.today

CVE Published

Aug 05, 2026 - 16:18 nvd

HIGH 8.6

DescriptionCVE.org

A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to improper handling when parsing a specific BEEP SOAP request. An attacker could exploit this vulnerability by sending a specific BEEP SOAP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.

AnalysisAI

Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticated remote attacker to force an unexpected device reload by sending a specially crafted BEEP SOAP request. The CVSS 8.6 score with Changed scope (S:C) reflects that a device reload disrupts all network services downstream of the affected device, amplifying impact beyond the immediate target. No public exploit or CISA KEV listing has been identified at time of analysis, though the low-complexity, no-authentication attack vector makes this a credible automated threat against any internet- or network-exposed IOS XE device running the BEEP feature.

Technical ContextAI

BEEP (Blocks Extensible Exchange Protocol, RFC 3080) is a generic application-layer framework designed to support multiple protocol channels, including SOAP (Simple Object Access Protocol) message transport. Cisco IOS XE implements a BEEP server that can receive SOAP-encoded management or protocol messages. CWE-388 (Error Condition Without Action) identifies the root cause: the BEEP parser fails to properly handle a specific malformed SOAP request, encountering an error state it cannot recover from, which propagates to cause the IOS XE process to crash and the device to reload. The affected CPE (cpe:2.3:a:cisco:cisco_ios_xe_software) covers the Linux-based IOS XE operating system running across Cisco's enterprise and service-provider router and switch platforms. The breadth of affected versions - spanning train 16.6 through 26.x - indicates the vulnerable BEEP parsing code has been present across many release generations.

RemediationAI

The primary remediation is to upgrade to a fixed Cisco IOS XE Software release as specified in the Cisco Security Advisory cisco-sa-iosxe-bing-MGHrFAkd (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-bing-MGHrFAkd). Exact fixed version numbers are not independently confirmed from the available data - consult the advisory's Software Checker tool to identify the appropriate fixed release for your specific train. As an immediate compensating control, disable the BEEP feature on affected devices if it is not operationally required; this eliminates the attack surface entirely. If BEEP must remain enabled, apply interface or infrastructure ACLs to restrict access to the BEEP listener port to only trusted management hosts, preventing unauthenticated external actors from reaching the service. Note that ACL-based filtering is a mitigation, not a fix, and should be paired with patching as soon as possible.