EUVD-2026-53461
GHSA-64g3-r786-fjmf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
PR:L confirmed by authentication requirement; A:L because only the WebUI process becomes unresponsive, not the full device; no confidentiality or integrity impact described.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to perform a denial of service (DoS) attack against an affected device.
This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the web-based management interface to become unresponsive.
AnalysisAI
Denial-of-service in Cisco IOS XE Software's web-based management interface (WebUI) allows an authenticated remote attacker holding only low-privilege credentials to render the management interface unresponsive by sending crafted input that bypasses input validation. The vulnerability spans an exceptionally broad version footprint - from 16.9.x through the 26.x release train - making patching scope significant for organizations running Cisco enterprise routing and switching infrastructure. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, placing real-world urgency below its broad scope might suggest.
Technical ContextAI
Cisco IOS XE Software is the operating system underpinning Cisco's enterprise-grade routers and switches across campus, WAN, and data center deployments. The affected component is the web-based management interface (WebUI), an HTTP/HTTPS-served management plane that enables device configuration and monitoring without CLI access. The root cause is classified as CWE-269 (Improper Privilege Management), indicating the system fails to adequately constrain what operations a low-privilege authenticated session may trigger - a low-privilege account can submit crafted input that induces an error or resource-exhaustion condition in the WebUI process, making it unresponsive. The CPE string cpe:2.3:a:cisco:cisco_ios_xe_software:*:*:*:*:*:*:*:* encompasses the entire IOS XE application family; EUVD-2026-53461 enumerates over 200 discrete affected sub-versions across release trains 16.9 through 26.2, confirming broad exposure across Cisco's modern switching and routing portfolio.
RemediationAI
Consult Cisco Security Advisory cisco-sa-webui-dos-qdc7qx3 at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-dos-qdc7qx3 for the authoritative fixed release mapping per IOS XE train - exact patched versions are not specified in the available intelligence and must be obtained directly from the Cisco advisory. As an interim compensating control, disable the web-based management interface entirely if it is not operationally required by issuing 'no ip http server' and 'no ip http secure-server' in global configuration; note this will disable all WebUI-dependent management functions including Cisco DNA Center integration on relevant platforms, so assess operational impact before applying. Where the WebUI must remain active, restrict access via infrastructure ACLs applied to the HTTP/HTTPS management port, limiting reachability to trusted administrator source IPs only - this does not eliminate the vulnerability but significantly reduces exposure to only explicitly authorized sessions, and combined with strong credential hygiene (not issuing low-privilege accounts to untrusted users) provides meaningful risk reduction.
More in Cisco Ios Xe Software
View allImproper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthentic
Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to g
Denial-of-service via malformed XMCP packets forces unexpected reloads of Cisco IOS and IOS XE devices, exploitable by a
Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticate
Unauthenticated remote denial-of-service affecting Cisco IOS XE Software across a wide version range results from multip
Unauthenticated remote denial-of-service in Cisco IOS XE Software allows network-accessible attackers to crash IOS proce
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discovera
Unauthenticated remote attackers can cause high availability impact with scope change on Cisco IOS XE Software through i
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a com
Improper BOOTP packet handling in Cisco IOS XE Software on Catalyst 9000 Series Switches allows unauthenticated remote a
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Denial of service in Cisco IOS XE Software's SNMP subsystem allows an authenticated remote attacker to force an affected
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today