EUVD-2026-53454
GHSA-3vcg-p7rg-2799
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Network-exploitable unauthenticated memory corruption causes high availability impact with scope change due to IOS XE's critical routing/switching role; no confidentiality or integrity impact identified.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20268 are related to issues with improper restriction of operations within the bounds of a memory buffer that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-119.
AnalysisAI
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a complete denial of service with Changed scope (S:C), potentially cascading disruption to downstream network segments that depend on the affected routing or switching infrastructure. Affecting an extremely broad range of IOS XE release trains from 16.6.x through 26.1.x across hundreds of specific builds, this vulnerability was discovered and self-reported by Cisco's own engineering team during a proactive internal security hardening review - not in response to observed attacks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Based on the CVSS vector AV:N/AC:L/PR:N/UI:N/S:C, no special configuration, authentication, or specific feature enablement is required - an unauthenticated remote attacker needs only IP-level reachability to an affected Cisco IOS XE device to attempt exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.6 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H represents a meaningful operational risk for any organization relying on Cisco IOS XE infrastructure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker with network reachability to an affected Cisco IOS XE device constructs and transmits specially crafted network packets that trigger improper memory buffer handling within a network-facing IOS XE component, causing a process crash or forced device reload and resulting in denial of service. Due to the Changed scope (S:C) CVSS metric, the disruption can cascade to downstream network segments that route through the affected device, potentially causing broader outages across enterprise or service-provider networks. … |
| Remediation | Consult the Cisco Security Advisory cisco-sa-hardening-iosxe-V8NMuMZJ (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ) and use Cisco's Software Checker tool to identify the specific fixed IOS XE release for your platform and train - exact patched version numbers per train are not enumerated in available intelligence data and must be confirmed directly via the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cisco IOS XE devices and identify which are running versions 16.6.x through 26.1.x, then assess the business criticality of each affected device. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Ios Xe Software
View allImproper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthentic
Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to g
Denial-of-service via malformed XMCP packets forces unexpected reloads of Cisco IOS and IOS XE devices, exploitable by a
Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticate
Unauthenticated remote denial-of-service affecting Cisco IOS XE Software across a wide version range results from multip
Unauthenticated remote denial-of-service in Cisco IOS XE Software allows network-accessible attackers to crash IOS proce
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discovera
Unauthenticated remote attackers can cause high availability impact with scope change on Cisco IOS XE Software through i
Denial of service in Cisco IOS XE Software's SNMP subsystem allows an authenticated remote attacker to force an affected
Denial of service in Cisco IOS XE Software's web-based management interface allows an authenticated remote attacker with
Denial-of-service in Cisco IOS XE Software's web-based management interface (WebUI) allows an authenticated remote attac
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today