EUVD-2026-70202
GHSA-6p8v-vwv7-4vg4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify IOS XR device from internet or peering session
-
DeliverySend crafted protocol traffic (unauthenticated)
-
ExploitTrigger protection mechanism bypass (CWE-693)
-
ExecutionCause control-plane or data-plane process crash
-
ImpactSustained availability disruption on router
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | No special conditions beyond network reachability to the affected IOS XR device are indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The attacker does not need valid credentials. Because the description groups multiple CWE-693 issues under one CVE, the specific protocol or service surface (e.g., BGP, OSPF, management plane, NETCONF) is not disclosed in available data - the advisory at Cisco's portal should be consulted to determine which services are affected and whether disabling specific features constitutes a viable workaround. What limits exploitation: the vulnerability was internally discovered, no exploit code exists publicly, and IOS XR is typically not directly internet-exposed on all interfaces in hardened deployments. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) signals a remotely exploitable, unauthenticated vulnerability with high availability impact and low complexity - attributes that place this in the 'patch immediately' tier for internet-exposed infrastructure. However, several caveats apply. First, Cisco's description is deliberately terse ('protection mechanism failure issues'), making independent verification of the exact exploitation mechanism impossible from available data. Second, this vulnerability was internally discovered, suggesting no active exploitation exists yet. Third, no EPSS data was provided, so probabilistic exploitation likelihood cannot be quantified. The I:L score (limited integrity impact) alongside A:H suggests possible route-table manipulation or control-plane disruption rather than full device compromise. For IOS XR operators - particularly service providers - any unauthenticated network-reachable DoS against core routing infrastructure carries outsized real-world risk, regardless of scope being unchanged (S:U). Prioritize patching for internet-facing or untrusted-peering interfaces. |
| Exploit ScenarioDerived | A remote attacker with network reachability to an IOS XR router interface sends specially crafted network traffic that bypasses or neutralizes a protection control - such as a rate limiter, ACL enforcement, or authentication guard - causing the targeted control-plane or data-plane process to crash or become unavailable. Because no authentication is required and complexity is low, this could be automated. No public proof-of-concept has been identified at time of analysis, and exploitation was not observed prior to Cisco's internal discovery. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Protection mechanism failures in Cisco IOS XR Software allow remote unauthenticated attackers to achieve high availability disruption and limited integrity impact against affected routers. Discovered through Cisco's own internal security audit, this CVE bundles multiple CWE-693 class weaknesses addressed in a coordinated hardening release. No active exploitation has been identified, but the combination of network-reachability, no authentication requirement, and an A:H CVSS impact score makes this a high-priority patch for service-provider and carrier-grade router deployments.
RemediationAI
The primary remediation is to apply Cisco's hardening software release documented in the advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM - exact fixed versions are not independently confirmed from available data and must be retrieved from that advisory. As a compensating control pending patching, restrict management-plane and control-plane access using IOS XR's Control Plane Policing (CoPP) feature to rate-limit or drop unexpected protocol traffic from untrusted sources; note this reduces but may not eliminate risk depending on the specific protection mechanism involved. Additionally, apply infrastructure ACLs (iACLs) to block unauthenticated access from untrusted network segments to routing protocol ports and management interfaces. These mitigations carry the trade-off of potentially disrupting legitimate BGP peer sessions or management access if misconfigured.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco IOS XR is the operating system running on Cisco's carrier-grade and high-end enterprise routers - including the ASR 9000, NCS, CRS, and 8000 series - widely deployed in ISP backbone and large enterprise core networks. CWE-693 (Protection Mechanism Failure) covers flaws where a security control (ACL, firewall rule, authentication guard, rate limiter, etc.) fails to operate as intended, allowing an attacker to bypass or undermine it. The CPE cpe:2.3:a:cisco:cisco_ios_xr_software:*:*:*:*:*:*:*:* uses a wildcard, indicating no specific version has been scoped in NVD data - all versions should be considered at risk until Cisco's advisory narrows the range. The description explicitly notes multiple issues are grouped under this single CVE, which is consistent with Cisco's practice for internal hardening releases.
Know when Cisco Ios Xr Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Network-reachable, unauthenticated protection bypass causing high availability and low integrity impact; no confidentiality loss per description.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20277 are related to protection mechanism failure issues that are grouped under the Common Weakness Enumeration (CWE) CWE-693.
Executive ViewAI
Cisco IOS XR Software deployed in service-provider and carrier-grade router infrastructures contains multiple protection mechanism failures allowing remote unauthenticated attackers to disrupt network availability and compromise system integrity. No public exploit identified at time of analysis, but the ease of attack and network-accessible nature of the vulnerability warrant rapid remediation. This affects critical infrastructure relied upon for enterprise and customer connectivity, with potential for widespread service outages across carrier networks.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to router management interfaces through access control lists and perimeter firewalls, implementing enhanced monitoring to detect anomalous router behavior including unexpected resets or state changes, applying rate-limiting on exposed network interfaces to reduce attack surface, maintaining regular coordination with Cisco regarding patch availability and testing timelines, and considering network segmentation to limit potential blast radius if a device becomes compromised.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Cisco Ios Xr Software
View allImproper resource lifecycle control (CWE-664) in Cisco IOS XR Software is addressed by a batch software-hardening releas
Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restric
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privile
Improper handling of exceptional conditions (CWE-703) in Cisco IOS XR Software allows an authenticated, remote attacker
Incorrect calculation vulnerabilities (CWE-682) in Cisco IOS XR Software allow an unauthenticated attacker on an adjacen
Insufficient control flow management weaknesses (CWE-691) in Cisco IOS XR Software allow unauthenticated remote attacker
Crafted IPv4 packets addressed to the router itself can drive the line card network processor on Cisco IOS XR into repea
Exploit-DB