---
id: CVE-2026-20277
title: >-
  As part of Cisco's ongoing commitment to proactive security and product
  quality, the Cisco IOS XR Software engineering team has conducted a
  comprehensive internal security review
summary: >-
  As part of Cisco's ongoing commitment to proactive security and product
  quality, the Cisco IOS XR Software engineering team has conducted a
  comprehensive internal security review. This review resulted in a software
  hardening releases tha…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'
cwe:
  - CWE-693
vendor: Cisco
product: Cisco IOS XR Software
affected:
  - ios_xr_software 6.5.29
  - ios_xr_software 7.0.1
  - ios_xr_software 6.5.26
  - ios_xr_software 6.5.25
  - ios_xr_software 6.5.28
  - ios_xr_software 6.5.90
  - ios_xr_software 7.1.1
  - ios_xr_software 7.0.90
  - ios_xr_software 6.7.1
  - ios_xr_software 7.0.2
  - ios_xr_software 7.1.15
  - ios_xr_software 7.2.1
  - ios_xr_software 7.1.2
  - ios_xr_software 6.7.2
  - ios_xr_software 7.0.11
  - ios_xr_software 7.0.12
  - ios_xr_software 7.0.14
  - ios_xr_software 7.1.25
  - ios_xr_software 7.2.12
  - ios_xr_software 7.3.1
  - ios_xr_software 7.1.3
  - ios_xr_software 6.7.3
  - ios_xr_software 7.4.1
  - ios_xr_software 7.2.2
  - ios_xr_software 6.7.4
  - ios_xr_software 6.5.31
  - ios_xr_software 7.3.15
  - ios_xr_software 7.3.16
  - ios_xr_software 6.8.1
  - ios_xr_software 7.4.15
  - ios_xr_software 6.5.32
  - ios_xr_software 7.3.2
  - ios_xr_software 7.5.1
  - ios_xr_software 7.4.16
  - ios_xr_software 7.3.27
  - ios_xr_software 7.6.1
  - ios_xr_software 7.5.2
  - ios_xr_software 7.8.1
  - ios_xr_software 7.6.15
  - ios_xr_software 7.5.12
  - ios_xr_software 7.8.12
  - ios_xr_software 7.3.3
  - ios_xr_software 7.7.1
  - ios_xr_software 6.8.2
  - ios_xr_software 7.3.4
  - ios_xr_software 7.4.2
  - ios_xr_software 6.7.35
  - ios_xr_software 6.9.1
  - ios_xr_software 7.6.2
  - ios_xr_software 7.5.3
published: '2026-09-02'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T13:17:28.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-20277'
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM
    label: psirt@cisco.com
  - url: >-
      https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://software.cisco.com'
tags:
  - nvd
  - cve.org
  - csaf
  - vendor-advisory
  - cisco
epss: 0.00233
epssPercentile: 0.12571
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-02T16:49:28.450902Z'
ingestedAt: '2026-09-12T05:42:02.746Z'
---

## Overview

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20277 are related to protection mechanism failure issues that are grouped under the Common Weakness Enumeration (CWE) CWE-693.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **cisco-sa-hardening-iosxr-qg64NcM** · Cisco · affected: Cisco IOS XR Software (259 versions) · updated 2026-09-17 · [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM)