CVE-2026-20279
CriticalCVSS 9.8Summary
A vulnerability in Cisco IOS XR Software relates to improper access control issues (CWE-284). It was discovered during an internal security review and addressed in software hardening releases.
Risk Assessment
The risk involves potential unauthorized access to system resources, which could compromise data integrity and confidentiality in environments using IOS XR.
Recommendation
Apply the latest Cisco IOS XR hardening releases that include fixes for this vulnerability.
Other vulnerabilities in Cisco IOS XR
See all- CVE-2016-6428High
Cisco IOS XR version 6.1.1 allows local users to execute arbitrary OS commands as root by leveraging admin privileges.
- CVE-2016-1456High
The CLI in Cisco IOS XR versions 6.x through 6.0.1 allows local users to execute arbitrary OS commands in a privileged context by leveraging unspecified container access.
- CVE-2016-1407High
Cisco IOS XR versions up to 5.3.2 mishandle Local Packet Transport Services (LPTS) flow-based entries, allowing remote attackers to cause a denial of service (session drop) by making many connection attempts to open TCP ports.
- CVE-2015-6432High
Cisco IOS XR versions 4.2.0, 4.3.0, 5.0.0, 5.1.0, 5.2.0, 5.2.2, 5.2.4, 5.3.0, and 5.3.2 do not properly restrict the number of Path Computation Elements (PCEs) for OSPF LSA opaque area updates, allowing remote attackers to cause a denial of service (device reload) via a crafted update.
- CVE-2015-0618High
Cisco IOS XR versions 5.0.1 and 5.2.1 on Network Convergence System 6000 devices and 5.1.3 and 5.1.4 on Carrier Routing System X devices allow remote attackers to cause a denial of service (line-card reload) via malformed IPv6 packets with extension headers.
- CVE-2014-3353High
Cisco IOS XR 4.3(.2) and earlier, used in Cisco Carrier Routing System (CRS), allows remote attackers to cause a denial of service by sending a malformed IPv6 packet.
- CVE-2026-20274Critical
A vulnerability in Cisco IOS XR Software relates to improper resource control issues (CWE-664). It was discovered during an internal security review and addressed in software hardening releases.
Original NVD description (English source)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20279 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.