What is the CVSS score of EUVD-2026-53453?

EUVD-2026-53453 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Cisco IOS XE are affected by EUVD-2026-53453?

Cisco IOS XE Software, widely deployed in enterprise networks, contains a critical remote authentication bypass vulnerability (CVE-2026-20267, CVSS 9.0) that could allow unauthorized access to…

How to fix or mitigate EUVD-2026-53453?

Within 24 hours, inventory all Cisco IOS XE devices in production, document current versions, and assess exposure based on network access controls and geographic distribution. Over the next 7 days, immediately implement network segmentation to restrict direct access to affected devices, enable enhanced logging and monitoring for suspicious authentication attempts, and where possible deploy intrusion prevention systems configured to detect exploitation attempts. Within 30 days, continue monitoring Cisco security advisories for patch availability, develop an emergency patching plan for rapid deployment once a fix is released, conduct threat modeling to identify business-critical systems requiring additional protective measures, and consider supplementary controls such as multi-factor authentication or certificate-based access where supported.

Cisco IOS XE EUVD-2026-53453

| CVE-2026-20267 CRITICAL

Improper Access Control (CWE-284)

2026-08-05 cisco

GHSA-fhmv-662f-c3vp

Authentication Bypass Apple Cisco Cisco Ios Xe Software

9.0

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Remote unauthenticated access-control/auth bypass (AV:N, PR:N) but non-trivial preconditions justify AC:H; changed scope and full C/I/A impact match a critical device compromise.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:29 vuln.today

CVE Published

Aug 05, 2026 - 16:18 nvd

CRITICAL 9.0

DescriptionCVE.org

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20267 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

AnalysisAI

Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to gain unauthorized access with a scope-changing impact affecting confidentiality, integrity, and availability across affected components. The issue was discovered internally by Cisco's engineering team during a proactive security review and is grouped under CWE-284 with a CVSS base score of 9.0, though the high attack complexity (AC:H) indicates non-trivial preconditions. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Cisco IOS XE is the Linux-based network operating system that runs across Cisco's enterprise routing and switching platforms (Catalyst switches, ASR/ISR routers, wireless controllers, and related gear). The root cause is classified under CWE-284 (Improper Access Control), used here as a CWE Pillar because CVE-2026-20267 bundles multiple internally discovered access-control weaknesses rather than a single flaw. The associated 'Authentication Bypass' tag indicates that one or more of these weaknesses let an actor reach functionality or resources that should be gated behind authentication or authorization checks. The single CPE provided, cpe:2.3:a:cisco:cisco_ios_xe_software:*:*:*:*:*:*:*:*, is a wildcard covering the software family generally rather than pinpointing a specific feature or subsystem.

RemediationAI

Upgrade to a fixed Cisco IOS XE release as directed by the Cisco Security Advisory cisco-sa-hardening-iosxe-V8NMuMZJ (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ); because the input does not include a single authoritative fix version and the affected list spans many trains, use the advisory's Fixed Software section and the Cisco Software Checker to map your exact running version to the correct hardened build. No exact fix version can be cited from the provided data, so do not act on an assumed version number. As compensating controls until patching, restrict management-plane access by applying control-plane policing and infrastructure ACLs so that only trusted administrative subnets can reach management services, disable any unused management protocols or web/HTTP(S) management interfaces on the device, and enforce authentication hardening (AAA, strong VTY access-class restrictions) - with the trade-off that tightening management ACLs can disrupt legitimate remote administration and NMS/monitoring reachability if not scoped carefully. Because the precise affected feature is not named, treat management-plane exposure reduction as the highest-value interim mitigation.