What is the CVSS score of EUVD-2026-53467?

EUVD-2026-53467 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Cisco IOS XE are affected by EUVD-2026-53467?

Cisco IOS and IOS XE devices are vulnerable to remote denial-of-service attacks via malformed XMCP packets, potentially disabling entire network infrastructure without authentication.

How to fix or mitigate EUVD-2026-53467?

Immediate action (24 hours): Inventory all Cisco IOS and IOS XE devices and identify services dependent on XMCP functionality. Within 7 days: Deploy network-level mitigations including ACL restrictions limiting XMCP protocol access to authorized sources only, enable rate-limiting on border devices, and disable XMCP services where operationally feasible. Over 30 days: Monitor Cisco security advisories for patch availability and establish a testing plan for immediate deployment once vendor releases remediation; simultaneously implement network segmentation to isolate critical devices until patching is possible.

Cisco IOS XE EUVD-2026-53467

| CVE-2026-20301 HIGH

Unchecked Input for Loop Condition (CWE-606)

2026-08-05 cisco

GHSA-vfv8-7h88-hj2w

Denial Of Service Apple Cisco Cisco Ios Xe Software

8.6

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

8.6 HIGH

Network-reachable, unauthenticated, single-packet exploitation causing full device reload with changed scope; no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:25 vuln.today

CVE Published

Aug 05, 2026 - 16:28 nvd

HIGH 8.6

DescriptionCVE.org

A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to improper handling of malformed XMCP packets. An attacker could exploit this vulnerability by sending a malformed XMCP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition. The attacker does not need the XMCP client username to exploit this vulnerability.

AnalysisAI

Denial-of-service via malformed XMCP packets forces unexpected reloads of Cisco IOS and IOS XE devices, exploitable by any remote unauthenticated attacker. The CVSS scope change (S:C) reflects that the reload impacts the entire device, not just the XMCP subsystem, bringing down all services simultaneously. No public exploit or CISA KEV listing exists at time of analysis, but the zero-authentication, low-complexity attack vector - combined with Cisco's ubiquitous enterprise footprint - makes this a high-priority patching target for network operations teams.

Technical ContextAI

XMCP (Extensible Messaging Client Protocol), also referred to by Cisco as the External Client Protocol, is a Cisco-proprietary protocol used in IOS and IOS XE for external client communications, often in Unified Communications-adjacent contexts. The root cause is CWE-606 (Unchecked Input for Loop Condition), meaning the IOS/IOS XE XMCP parser fails to properly validate a specific malformed packet field before using it to control a processing loop or similar iterative operation. This unvalidated input drives the device into an abnormal processing state - consuming resources or triggering a fatal condition - ultimately causing the entire device to reload. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H is consistent with Cisco's standard scoring practice for process-crash vulnerabilities that cause a full device reload: the Changed Scope reflects that all device services (routing, switching, security functions) are interrupted, not just the XMCP component. Both CPE strings cpe:2.3:a:cisco:cisco_ios_xe_software and cpe:2.3:a:cisco:ios confirm both product lines are affected across a wide range of release trains.

RemediationAI

Cisco has published Security Advisory cisco-sa-ios-xmcp-thbAr34t at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xmcp-thbAr34t, which contains fixed software version details and Cisco's Software Checker for identifying whether a specific installed version is affected. Fixed version numbers are not included in the available input data and must be confirmed directly via the advisory. As a compensating control where immediate patching is not feasible, administrators should disable the XMCP (External Client Protocol) service on affected devices if it is not operationally required - this eliminates the attack surface entirely, though doing so will break any Cisco Unified Communications or external client integrations that depend on this protocol. Where XMCP must remain enabled, restrict XMCP traffic using interface-level ACLs to permit packets only from known, trusted XMCP client IP addresses, blocking all other sources; this reduces but does not eliminate exposure if trusted source addresses are spoofable or compromised. Confirm XMCP listener status and bound interfaces before deploying ACLs to avoid incomplete coverage.