Español
English
Deutsch
Cisco has published 7 vulnerabilities: 2 of critical severity and 5 of high severity. If exploited, they could allow an attacker to perform code execution, cause a denial of service, or access protected functions or resources without authorization.
Among the patched vulnerabilities are:
🔴 CVE-2026-20274: An improper resource control vulnerability, which could allow for memory corruption, out-of-bounds read/write, code execution, or denial of service.
🔴 CVE-2026-20275: An incorrect calculation vulnerability, which could allow for memory corruption or code execution, as well as a possible denial of service.
🔴 CVE-2026-20276: An insufficient control flow management vulnerability, which could allow for a denial of service or block execution.
🔴 CVE-2026-20277: A protection mechanism failure vulnerability, which could allow security mechanisms to be bypassed.
🔴 CVE-2026-20278: An improper neutralization vulnerability, which could allow for command or code injection, or manipulation of input indexes and quantities, potentially leading to code execution or unauthorized access/manipulation.
🔴 CVE-2026-20279: An improper access control vulnerability, which could allow access to protected functions or resources without authentication/authorization.
🔴 CVE-2026-20280: An improper handling of exceptional conditions vulnerability, which could lead to insecure behaviors, control bypasses, or denial of service.
💻 Affected Products
Cisco:
Cisco IOS XR Software:
All versions of Cisco IOS XR Software, including Cisco IOS XR7 (LNT), regardless of device configuration.
Cisco IOS XR7 (LNT):
Cisco 8000 Series Routers;
Cisco NCS 1010;
Cisco NCS 540L Routers;
Cisco NCS 5700 Series;
All versions of IOS XR7 (LNT).
BGP:
Cisco IOS XR 7.10 and earlier;
Cisco IOS XR 26.2.1 and earlier, depending on the platform;
Other versions and platforms.
crypto-ike:
All versions and platforms.
gRPC:
All versions and platforms.
IP-SLA:
All versions and platforms.
IS-IS (Intermediate System-to-Intermediate System):
Cisco IOS XR 25.4.1 and 25.4.2;
Cisco IOS XR 26.1.2 and 26.2.1;
Other versions and platforms.
MPLS:
All versions and platforms.
MPLS-TE:
All versions and platforms.
Multicast:
Cisco IOS XR 26.1.2 and 26.2.1;
Other versions and platforms.
OSPF:
All versions and platforms.
Segment Routing IPv6:
Cisco IOS XR 7.11.21;
Cisco IOS XR 24.2.21;
Cisco IOS XR 25.2.21;
Cisco IOS XR 25.4.1;
Cisco IOS XR 7.9.21 on 64-bit Cisco ASR 9000 Series;
Cisco IOS XR 7.3.2 on Cisco NCS 1002;
Other versions and platforms.
Segment Routing IPv4 or IPv4 and IPv6:
All versions and platforms.
TCP Authentication Option:
All versions and platforms.
Zero Touch Provisioning (ZTP):
All versions and platforms, except Cisco IOS XR 26.2.1.
💥 Solution
🛡️ Cisco recommends updating to the patched versions that fix the vulnerabilities, using the corresponding SMUs (Software Maintenance Upgrades):
💥 Cisco IOS XR Software 7.3.2, only for the Cisco NCS 1002 optical platform.
💥 Cisco IOS XR Software 7.9.2 or 7.9.21.
💥 Cisco IOS XR Software 7.10.2.
💥 Cisco IOS XR Software 7.11.2 or 7.11.21.
💥 Cisco IOS XR Software 24.1.2, when available.
💥 Cisco IOS XR Software 24.2.2 or 24.2.21.
💥 Cisco IOS XR Software 24.3.2, when available.
💥 Cisco IOS XR Software 24.4.2.
💥 Cisco IOS XR Software 25.1.2, when available.
💥 Cisco IOS XR Software 25.2.21 or 25.2.2, when available.
💥 Cisco IOS XR Software 25.4.1, only for the Cisco NCS 1001, Cisco NCS 1004, and Cisco NCS 1010 optical platforms.
💥 Cisco IOS XR Software 25.4.2, for non-optical platforms.
💥 Cisco IOS XR Software 26.1.2.
💥 Cisco IOS XR Software 26.2.1.
💥 Cisco IOS XR Software 26.2.2, when available.
💥 Cisco IOS XR Software 26.3.1, when available.
🛡️ Recommendations
✅ Identify the affected equipment.
✅ Update Cisco products to the patched version.
✅ Verify that all equipment is using an updated version.
✅ Monitor for potential Indicators of Compromise (IoCs).
⚠️ If the update is not currently available, monitor its release to apply it as soon as possible.
🔎 More Information: