EUVD-2026-53467
GHSA-vfv8-7h88-hj2w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Network-reachable, unauthenticated, single-packet exploitation causing full device reload with changed scope; no confidentiality or integrity impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper handling of malformed XMCP packets. An attacker could exploit this vulnerability by sending a malformed XMCP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition. The attacker does not need the XMCP client username to exploit this vulnerability.
AnalysisAI
Denial-of-service via malformed XMCP packets forces unexpected reloads of Cisco IOS and IOS XE devices, exploitable by any remote unauthenticated attacker. The CVSS scope change (S:C) reflects that the reload impacts the entire device, not just the XMCP subsystem, bringing down all services simultaneously. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | XMCP (External Client Protocol) must be enabled and network-reachable on the target device - this protocol serves specific Cisco client integration use cases and is not universally active across all IOS/IOS XE deployments, making it a non-default configuration dependency that limits the exposed population. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.6 is appropriate and reflects genuine operational risk: AV:N/AC:L/PR:N/UI:N means any network-reachable attacker can exploit this with a single malformed packet and no credentials, and S:C elevates the score because device reload takes down all services. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker identifies a Cisco IOS XE device with XMCP (External Client Protocol) enabled and network-accessible - discoverable via banner grabbing or protocol-specific scanning. The attacker sends a single crafted malformed XMCP packet to the device; no username, password, or prior authentication is required. … |
| Remediation | Cisco has published Security Advisory cisco-sa-ios-xmcp-thbAr34t at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xmcp-thbAr34t, which contains fixed software version details and Cisco's Software Checker for identifying whether a specific installed version is affected. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediate action (24 hours): Inventory all Cisco IOS and IOS XE devices and identify services dependent on XMCP functionality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Ios Xe Software
View allImproper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthentic
Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to g
Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticate
Unauthenticated remote denial-of-service affecting Cisco IOS XE Software across a wide version range results from multip
Unauthenticated remote denial-of-service in Cisco IOS XE Software allows network-accessible attackers to crash IOS proce
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discovera
Unauthenticated remote attackers can cause high availability impact with scope change on Cisco IOS XE Software through i
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a com
Denial of service in Cisco IOS XE Software's SNMP subsystem allows an authenticated remote attacker to force an affected
Denial of service in Cisco IOS XE Software's web-based management interface allows an authenticated remote attacker with
Denial-of-service in Cisco IOS XE Software's web-based management interface (WebUI) allows an authenticated remote attac
Same weakness CWE-606 – Unchecked Input for Loop Condition
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today