EUVD-2026-70208
GHSA-cf4p-9ff3-r3m3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable management interface, low complexity, requires authenticated low-privilege user; full C/I/A consistent with improper neutralization enabling injection or equivalent impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
4DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20278 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) CWE-707.
AnalysisAI
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privileges to achieve full confidentiality, integrity, and availability impact against affected devices. The vulnerabilities were identified internally by Cisco's security engineering team and addressed in a batch hardening release, reference advisory cisco-sa-hardening-iosxr-qg64NcM. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege credential on the target Cisco IOS XR device - the CVSS PR:L metric confirms authentication is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score with AV:N/AC:L/PR:L reflects a genuinely elevated risk profile: network-reachable, low complexity, and requiring only a low-privilege credential, which is achievable by any authenticated operator or user account on the device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a Cisco IOS XR software release that includes the hardening fix documented in advisory cisco-sa-hardening-iosxr-qg64NcM, available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct comprehensive inventory of all Cisco IOS XR deployments in production, document current software versions, and assess exposure based on who holds valid administrative credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Ios Xr Software
View allImproper resource lifecycle control (CWE-664) in Cisco IOS XR Software is addressed by a batch software-hardening releas
Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restric
Improper handling of exceptional conditions (CWE-703) in Cisco IOS XR Software allows an authenticated, remote attacker
Incorrect calculation vulnerabilities (CWE-682) in Cisco IOS XR Software allow an unauthenticated attacker on an adjacen
Remote unauthenticated denial-of-service conditions in Cisco IOS XR Software stem from multiple insufficient control flo
Protection mechanism failures in Cisco IOS XR Software allow remote unauthenticated attackers to achieve high availabili
Same weakness CWE-707 – Improper Neutralization
View allShare
External POC / Exploit Code
Leaving vuln.today