{"id":"CVE-2026-20277","title":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases tha…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cwe":["CWE-693"],"vendor":"Cisco","product":"Cisco IOS XR Software","affected":["ios_xr_software 6.5.29","ios_xr_software 7.0.1","ios_xr_software 6.5.26","ios_xr_software 6.5.25","ios_xr_software 6.5.28","ios_xr_software 6.5.90","ios_xr_software 7.1.1","ios_xr_software 7.0.90","ios_xr_software 6.7.1","ios_xr_software 7.0.2","ios_xr_software 7.1.15","ios_xr_software 7.2.1","ios_xr_software 7.1.2","ios_xr_software 6.7.2","ios_xr_software 7.0.11","ios_xr_software 7.0.12","ios_xr_software 7.0.14","ios_xr_software 7.1.25","ios_xr_software 7.2.12","ios_xr_software 7.3.1","ios_xr_software 7.1.3","ios_xr_software 6.7.3","ios_xr_software 7.4.1","ios_xr_software 7.2.2","ios_xr_software 6.7.4","ios_xr_software 6.5.31","ios_xr_software 7.3.15","ios_xr_software 7.3.16","ios_xr_software 6.8.1","ios_xr_software 7.4.15","ios_xr_software 6.5.32","ios_xr_software 7.3.2","ios_xr_software 7.5.1","ios_xr_software 7.4.16","ios_xr_software 7.3.27","ios_xr_software 7.6.1","ios_xr_software 7.5.2","ios_xr_software 7.8.1","ios_xr_software 7.6.15","ios_xr_software 7.5.12","ios_xr_software 7.8.12","ios_xr_software 7.3.3","ios_xr_software 7.7.1","ios_xr_software 6.8.2","ios_xr_software 7.3.4","ios_xr_software 7.4.2","ios_xr_software 6.7.35","ios_xr_software 6.9.1","ios_xr_software 7.6.2","ios_xr_software 7.5.3"],"published":"2026-09-02","updated":"2026-09-18","sourceUpdated":"2026-09-18T13:17:28.387","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20277","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM","label":"psirt@cisco.com"},{"url":"https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://software.cisco.com"}],"tags":["nvd","cve.org","csaf","vendor-advisory","cisco"],"epss":0.00233,"epssPercentile":0.14416,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-02T16:49:28.450902Z"},"ingestedAt":"2026-09-12T05:42:02.746Z","slug":"CVE-2026-20277","body":"## Overview\n\nAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20277 are related to protection mechanism failure issues that are grouped under the Common Weakness Enumeration (CWE) CWE-693.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **cisco-sa-hardening-iosxr-qg64NcM** · Cisco · affected: Cisco IOS XR Software (259 versions) · updated 2026-09-17 · [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}