CVE-2026-20274

Published Sep 2, 2026

Last updated a month ago

CVSS critical 9.8
Cisco IOS XR Software

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-20274 is a vulnerability found in Cisco IOS XR Software, categorized under Common Weakness Enumeration (CWE) CWE-664, which pertains to improper control of a resource through its lifetime. This issue was identified during a comprehensive internal security review conducted by the Cisco IOS XR Software engineering team. The vulnerability allows a remote attacker to exploit the system by sending specially crafted input. Successful exploitation could lead to the execution of arbitrary code or cause a denial of service condition on the affected device.

Description
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20274 are related to improper resource control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-664.
Source
psirt@cisco.com
NVD status
Analyzed
Products
ios_xr

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

psirt@cisco.com
CWE-664

Social media

Hype score
Not currently trending
  1. Cisco's internal review of IOS XR produced two 9.8 criticals and a bundled fix release Cisco's security review of IOS XR found CVE-2026-20274 and CVE-2026-20279, both CVSS 9.8, plus three 8.8s, an 8.6 and an 8.2, all rolled into fixed releases Cisco strongly recommends.

    @EvanKirstel

    6 Sept 2026

    747 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🚨 Upozorňujeme na kritické zranitelnosti v Cisco Nexus 9000 Series Switches a Cisco IOS XR Software, CVE-2026-20212, CVE-2026-20274 a CVE-2026-20279. Zranitelnost CVE-2026-20212 umožňuje neautentizovanému vzdálenému útočníkovi spustit libovolný kód s oprávnění

    @GOVCERT_CZ

    4 Sept 2026

    487 Impressions

    1 Retweet

    7 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  3. #schwachstellen Cisco IOS XR: Kritische Schwachstelle CVE-2026-20274 aus interner Prüfung entdeckt #cisco #ciscoiosxr #cve202620274 #cwe664 https://t.co/aBXNbRTnU4

    @cybsecuritynews

    4 Sept 2026

    21 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 【また君か】Cisco IOS XRに複数の重大(Critical)な脆弱性。CVE-2026-20274はCVSSスコア9.8で、詳細非開示の境界外書き込み。CVE-2026-20279もCVSSスコア9.8で、不適切なアクセス制御。その他脆弱性も修正あり。 https://t.co/hVti

    @__kokumoto

    4 Sept 2026

    56906 Impressions

    25 Retweets

    74 Likes

    21 Bookmarks

    0 Replies

    3 Quotes

  5. Cisco released security updates for IOS XR addressing multiple vulnerabilities discovered internally. CVE-2026-20274 and CVE-2026-20279 score 9.8 CVSS due to resource management and access control flaws. Three additional issues score 8.8, with others at 8.6 and 8.2. No

    @WorldCyberNewsX

    3 Sept 2026

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations