CVE-2026-20272

Published Aug 5, 2026

Last updated 4 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-20272 identifies a group of vulnerabilities within Cisco IOS XE software, stemming from the improper neutralization of special elements. This collection of internally discovered weaknesses is categorized under CWE-74, which broadly covers injection issues such as command injection, operating system command injection, and argument injection. Rather than a single, conventional vulnerability with a specific exploitation path, CVE-2026-20272 acts as an umbrella identifier for multiple related bugs. Cisco's engineering team uncovered these issues during a comprehensive internal security review, leading to the release of software hardening updates to address them.

Description: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20272 are related to issues with improper neutralization of special elements that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.
Source: psirt@cisco.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@cisco.com: CWE-74

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

References