What is the CVSS score of EUVD-2026-53458?

EUVD-2026-53458 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Cisco IOS XE are affected by EUVD-2026-53458?

Cisco IOS XE Software contains a critical remote code execution vulnerability (CVSS 9.8) requiring no authentication, exposing your organization's network infrastructure to complete compromise by…

How to fix or mitigate EUVD-2026-53458?

Within 24 hours: conduct an urgent inventory of all Cisco IOS XE devices in your network and implement network segmentation to restrict remote access to affected systems from untrusted networks and external sources. Within 7 days: enable comprehensive traffic logging and monitoring (NetFlow or equivalent) on affected devices to detect exploitation attempts; contact Cisco Technical Assistance Center (TAC) regarding interim hardening configurations for your specific IOS XE software versions; prioritize devices by business criticality for remediation planning. Within 30 days: monitor Cisco security advisories continuously for patch availability and release information for CVE-2026-20272; establish a staging environment to test and validate patches before production deployment; evaluate the feasibility of additional compensating controls such as administrative access restrictions or temporary configuration hardening for highest-risk devices.

Cisco IOS XE EUVD-2026-53458

| CVE-2026-20272 CRITICAL

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-08-05 cisco

GHSA-cgmj-4p58-cx74

Information Disclosure Apple Cisco Cisco Ios Xe Software

9.8

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

CWE-74 injection reachable over the network with no auth or interaction and full device compromise supports AV:N/AC:L/PR:N/UI:N and C/I/A:H, matching Cisco; scope kept Unchanged absent evidence of cross-component impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:26 vuln.today

CVE Published

Aug 05, 2026 - 16:19 nvd

CRITICAL 9.8

DescriptionCVE.org

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20272 are related to issues with improper neutralization of special elements that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.

AnalysisAI

Improper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthenticated attackers to compromise the confidentiality, integrity, and availability of affected network devices, per Cisco's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical). The flaw was found during an internal Cisco security review and fixed via software hardening releases; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the disclosure is a bundled hardening advisory, the exact injection sink and affected feature/protocol are not specified, so the concrete attack surface is not confirmed from available data.

Technical ContextAI

Cisco IOS XE is the Linux-based network operating system running on a broad range of Cisco enterprise routing and switching platforms (Catalyst switches, ISR/ASR routers, Catalyst 9800 wireless controllers, and similar), identified here by cpe:2.3:a:cisco:cisco_ios_xe_software. The root cause is classified under CWE-74, the injection 'pillar' weakness: special elements in attacker-supplied input are not properly neutralized before being passed to a downstream interpreter, parser, or command context, which can encompass command injection, XML/expression injection, or similar sub-classes. Cisco groups multiple internally discovered issues under this single CVE, so more than one injection sink may be involved; the specific management-plane or data-plane component performing the unsafe parsing is not disclosed in the available intelligence.

RemediationAI

Upgrade to a fixed Cisco IOS XE hardening release as specified in Cisco advisory cisco-sa-hardening-iosxe-V8NMuMZJ (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ); use the Cisco Software Checker / advisory fixed-release table to map your exact running train to its patched build, since the advisory bundles multiple internally found issues and the exact fix version was not provided in this dataset. Patch available per vendor advisory - do not infer a version number, confirm the target release against the advisory before upgrading. As compensating controls until patched, restrict reachability of the device management and web/API planes: apply infrastructure ACLs and control-plane policing (CoPP) to permit management traffic only from trusted administrative subnets, disable any unused management services (HTTP/HTTPS server, unused NETCONF/RESTCONF or web UI features) with the trade-off that this removes those management channels, and place device management interfaces on an out-of-band network segment. These controls reduce exposure but do not eliminate the flaw if the vulnerable feature is required in production, so treat them as interim only.