Skip to main content

Cisco Releases IOS XR Software Security Hardening Guidance

The critical advisory addresses multiple vulnerability classes affecting Cisco IOS XR deployments

Threat ID:
CC-4842
Threat Severity:
Medium
Published:
3 September 2026 2:58 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

The critical advisory addresses multiple vulnerability classes affecting Cisco IOS XR deployments

Threat details

Introduction

Cisco has published a security hardening advisory for Cisco IOS XR Software following a comprehensive internal security review. The update addresses multiple vulnerability classes including improper control of resources, improper calculation, insufficient control flow management, protection mechanism failure, improper neutralization, improper access control, and improper check or handling of exceptional conditions vulnerabilities.

To streamline disclosure, Cisco grouped vulnerabilities according to their underlying Common Weakness Enumeration (CWE) category and assigned a single CVE identifier to each group. Several of the vulnerability classes have high severity ratings, with the most severe vulnerability carrying a CVSS score of 9.8.

Vulnerability Details

  • CVE-2026-20274 - 'Improper Control of a Resource Through its Lifetime' vulnerability - CVSSv3.1 score: 9.8
  • CVE-2026-20275 - 'Incorrect Calculation' vulnerability - CVSSv3.1 score: 8.8
  • CVE-2026-20276 - 'Insufficient Control Flow Management' vulnerability - CVSSv3.1 score: 8.6
  • CVE-2026-20277 - 'Protection Mechanism Failure' vulnerability - CVSSv3.1 score: 8.2
  • CVE-2026-20278 - 'Improper Neutralization' vulnerability - CVSSv3.1 score: 8.8
  • CVE-2026-20279 - 'Improper Access Control' vulnerability - CVSSv3.1 score: 9.8
  • CVE-2026-20280 - 'Improper Check or Handling of Exceptional Conditions' vulnerability - CVSSv3.1 score: 8.8

Remediation advice

Affected organisations are encouraged to review the Cisco cisco-sa-hardening-iosxr-qg64NcM advisory and apply relevant updates as soon as possible.

CVE Vulnerabilities

Status Published

CVE-2026-20274

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20274 are related to improper resource control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-664.
Status Published

CVE-2026-20275

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20275 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-682.
Status Published

CVE-2026-20276

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20276 are related to insufficient control flow management issues that are grouped under the Common Weakness Enumeration (CWE) CWE-691.
Status Published

CVE-2026-20277

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20277 are related to protection mechanism failure issues that are grouped under the Common Weakness Enumeration (CWE) CWE-693.
Status Published

CVE-2026-20278

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20278 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) CWE-707.
Status Published

CVE-2026-20279

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20279 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.
Status Published

CVE-2026-20280

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20280 are related to improper checking or handling of exceptional condition issues that are grouped under the Common Weakness Enumeration (CWE) CWE-703.

Last edited: 3 September 2026 2:58 pm