{"id":"CVE-2026-20276","title":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases tha…","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cwe":["CWE-691"],"vendor":"cisco","product":"ios_xr","affected":["ios_xr = 6.5.25","ios_xr = 6.5.26","ios_xr = 6.5.28","ios_xr = 6.5.29","ios_xr = 6.5.31","ios_xr = 6.5.32","ios_xr = 6.5.33","ios_xr = 6.5.35","ios_xr = 6.5.90","ios_xr = 6.5.351","ios_xr = 6.5.352","ios_xr = 6.5.353","ios_xr = 6.7.1","ios_xr = 6.7.2","ios_xr = 6.7.3","ios_xr = 6.7.4","ios_xr = 6.7.35","ios_xr = 6.8.1","ios_xr = 6.8.2","ios_xr = 6.9.1","ios_xr = 6.9.2","ios_xr = 7.0.0","ios_xr = 7.0.1","ios_xr = 7.0.2","ios_xr = 7.0.11","ios_xr = 7.0.12","ios_xr = 7.0.14","ios_xr = 7.0.90","ios_xr = 7.1.1","ios_xr = 7.1.2","ios_xr = 7.1.3","ios_xr = 7.1.15","ios_xr = 7.1.25","ios_xr = 7.2.0","ios_xr = 7.2.1","ios_xr = 7.2.2","ios_xr = 7.2.12","ios_xr = 7.3.1","ios_xr = 7.3.2","ios_xr = 7.3.3","ios_xr = 7.3.4","ios_xr = 7.3.5","ios_xr = 7.3.6","ios_xr = 7.3.15","ios_xr = 7.3.16","ios_xr = 7.3.27","ios_xr = 7.4.1","ios_xr = 7.4.2","ios_xr = 7.4.15","ios_xr = 7.4.16","ios_xr = 7.5.1","ios_xr = 7.5.2","ios_xr = 7.5.3","ios_xr = 7.5.4","ios_xr = 7.5.5","ios_xr = 7.5.12","ios_xr = 7.5.52","ios_xr = 7.6.1","ios_xr = 7.6.2","ios_xr = 7.6.3","ios_xr = 7.6.15","ios_xr = 7.7.1","ios_xr = 7.7.2","ios_xr = 7.7.21","ios_xr = 7.8.1","ios_xr = 7.8.2","ios_xr = 7.8.12","ios_xr = 7.8.22","ios_xr = 7.8.23","ios_xr = 7.9.1","ios_xr = 7.9.2","ios_xr = 7.9.21","ios_xr = 7.10.1","ios_xr = 7.10.2","ios_xr = 7.11.1","ios_xr = 7.11.2","ios_xr = 7.11.21","ios_xr = 24.1.1","ios_xr = 24.1.2","ios_xr = 24.2.1","ios_xr = 24.2.2","ios_xr = 24.2.11","ios_xr = 24.2.20","ios_xr = 24.2.21","ios_xr = 24.3.1","ios_xr = 24.3.2","ios_xr = 24.3.20","ios_xr = 24.3.30","ios_xr = 24.4.1","ios_xr = 24.4.2","ios_xr = 24.4.10","ios_xr = 24.4.15","ios_xr = 24.4.30","ios_xr = 25.1.1","ios_xr = 25.1.2","ios_xr = 25.1.30","ios_xr = 25.2.1","ios_xr = 25.2.2","ios_xr = 25.2.15","ios_xr = 25.2.30"],"published":"2026-09-02","updated":"2026-09-18","sourceUpdated":"2026-09-18T13:17:28.150","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20276","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM","label":"psirt@cisco.com"},{"url":"https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://software.cisco.com"}],"tags":["nvd","cve.org","csaf","vendor-advisory","cisco"],"epss":0.00267,"epssPercentile":0.19031,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-02T16:45:14.731008Z"},"ingestedAt":"2026-09-13T23:57:15.251Z","slug":"CVE-2026-20276","body":"## Overview\n\nAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20276 are related to insufficient control flow management issues that are grouped under the Common Weakness Enumeration (CWE) CWE-691.\n\n## Affected\n\n- `ios_xr = 6.5.25`\n- `ios_xr = 6.5.26`\n- `ios_xr = 6.5.28`\n- `ios_xr = 6.5.29`\n- `ios_xr = 6.5.31`\n- `ios_xr = 6.5.32`\n- `ios_xr = 6.5.33`\n- `ios_xr = 6.5.35`\n- `ios_xr = 6.5.90`\n- `ios_xr = 6.5.351`\n- `ios_xr = 6.5.352`\n- `ios_xr = 6.5.353`\n- `ios_xr = 6.7.1`\n- `ios_xr = 6.7.2`\n- `ios_xr = 6.7.3`\n- `ios_xr = 6.7.4`\n- `ios_xr = 6.7.35`\n- `ios_xr = 6.8.1`\n- `ios_xr = 6.8.2`\n- `ios_xr = 6.9.1`\n- `ios_xr = 6.9.2`\n- `ios_xr = 7.0.0`\n- `ios_xr = 7.0.1`\n- `ios_xr = 7.0.2`\n- `ios_xr = 7.0.11`\n- `ios_xr = 7.0.12`\n- `ios_xr = 7.0.14`\n- `ios_xr = 7.0.90`\n- `ios_xr = 7.1.1`\n- `ios_xr = 7.1.2`\n- `ios_xr = 7.1.3`\n- `ios_xr = 7.1.15`\n- `ios_xr = 7.1.25`\n- `ios_xr = 7.2.0`\n- `ios_xr = 7.2.1`\n- `ios_xr = 7.2.2`\n- `ios_xr = 7.2.12`\n- `ios_xr = 7.3.1`\n- `ios_xr = 7.3.2`\n- `ios_xr = 7.3.3`\n- `ios_xr = 7.3.4`\n- `ios_xr = 7.3.5`\n- `ios_xr = 7.3.6`\n- `ios_xr = 7.3.15`\n- `ios_xr = 7.3.16`\n- `ios_xr = 7.3.27`\n- `ios_xr = 7.4.1`\n- `ios_xr = 7.4.2`\n- `ios_xr = 7.4.15`\n- `ios_xr = 7.4.16`\n- `ios_xr = 7.5.1`\n- `ios_xr = 7.5.2`\n- `ios_xr = 7.5.3`\n- `ios_xr = 7.5.4`\n- `ios_xr = 7.5.5`\n- `ios_xr = 7.5.12`\n- `ios_xr = 7.5.52`\n- `ios_xr = 7.6.1`\n- `ios_xr = 7.6.2`\n- `ios_xr = 7.6.3`\n- `ios_xr = 7.6.15`\n- `ios_xr = 7.7.1`\n- `ios_xr = 7.7.2`\n- `ios_xr = 7.7.21`\n- `ios_xr = 7.8.1`\n- `ios_xr = 7.8.2`\n- `ios_xr = 7.8.12`\n- `ios_xr = 7.8.22`\n- `ios_xr = 7.8.23`\n- `ios_xr = 7.9.1`\n- `ios_xr = 7.9.2`\n- `ios_xr = 7.9.21`\n- `ios_xr = 7.10.1`\n- `ios_xr = 7.10.2`\n- `ios_xr = 7.11.1`\n- `ios_xr = 7.11.2`\n- `ios_xr = 7.11.21`\n- `ios_xr = 24.1.1`\n- `ios_xr = 24.1.2`\n- `ios_xr = 24.2.1`\n- `ios_xr = 24.2.2`\n- `ios_xr = 24.2.11`\n- `ios_xr = 24.2.20`\n- `ios_xr = 24.2.21`\n- `ios_xr = 24.3.1`\n- `ios_xr = 24.3.2`\n- `ios_xr = 24.3.20`\n- `ios_xr = 24.3.30`\n- `ios_xr = 24.4.1`\n- `ios_xr = 24.4.2`\n- `ios_xr = 24.4.10`\n- `ios_xr = 24.4.15`\n- `ios_xr = 24.4.30`\n- `ios_xr = 25.1.1`\n- `ios_xr = 25.1.2`\n- `ios_xr = 25.1.30`\n- `ios_xr = 25.2.1`\n- `ios_xr = 25.2.2`\n- `ios_xr = 25.2.15`\n- `ios_xr = 25.2.30`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **cisco-sa-hardening-iosxr-qg64NcM** · Cisco · affected: Cisco IOS XR Software (259 versions) · updated 2026-09-17 · [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM)","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}