VulnSocial

CVE-2026-20274Patch(cisco / ios_xr)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch cisco ios_xr systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20274 are related to improper resource control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-664.

cisco CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-664

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • ios_xr

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-09-04); latest day: 1
  • 5 total mentions across 4 days

Affected systems

Vendors
cisco
Products
ios_xr

111 versions affected across 1 product

Deep dive

Activity timeline5 mentions / 4d
01122Mentions · 2026-09-02: 1Mentions · 2026-09-03: 1Mentions · 2026-09-04: 2Mentions · 2026-09-06: 1Patch / Workaround · 2026-09-03: 1Patch / Workaround · 2026-09-04: 1Patch / Workaround · 2026-09-06: 1Technical Details · 2026-09-02: 1Technical Details · 2026-09-04: 1Technical Details · 2026-09-06: 109-0209-0309-0409-06
Signal classification2 categories
Patch
360.0%
Disclosure
240.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-021
Disclosure1
2026-09-031
Patch1
2026-09-042
Disclosure1Patch1
2026-09-061
Patch1
Full discourse5 posts
  • GovCERT.CZ@GOVCERT_CZ
    Patch

    🚨 Upozorňujeme na kritické zranitelnosti v Cisco Nexus 9000 Series Switches a Cisco IOS XR Software, CVE-2026-20212, CVE-2026-20274 a CVE-2026-20279. Zranitelnost CVE-2026-20212 umožňuje neautentizovanému vzdálenému útočníkovi spustit libovolný kód s oprávněními root na switchích Cisco Nexus 9000. Zranitelnost CVE-2026-20274 zahrnuje chyby správy prostředků v Cisco IOS XR, které mohou způsobit poškození paměti, přetečení vyrovnávací paměti, přístup mimo její hranice nebo stav use-after-free. Zranitelnost CVE-2026-20279 je způsobena nesprávným řízením přístupu v Cisco IOS XR a může vést k neoprávněnému přístupu k chráněným funkcím. Úspěšné zneužití může mít za následek spuštění libovolného kódu, kompromitaci zařízení, neoprávněný přístup nebo narušení dostupnosti služeb. Dotčeny jsou příslušné verze switchů Cisco Nexus 9000 a softwaru Cisco IOS XR včetně Cisco IOS XR7 (LNT). 📌Doporučujeme aktualizovat na nejnovější verzi.

    Post summary

    The notice highlights three critical CVEs in Cisco equipment, details their technical impact, and urges users to apply the latest firmware updates.

    01071912
    4.3K followersView on X
  • TheKnight7G@WH173H47
    Patch

    Cisco IOS XR Software's internal security review addresses CVE-2026-20274. If you're managing Cisco systems, check your software versions for patches to mitigate risks. #Cybersecurity

    Post summary

    Cisco IOS XR software has a disclosed vulnerability CVE-2026-20274; users are advised to verify and apply any available patches to mitigate potential risks.

    0001068
    21 followersView on X
  • Evan Kirstel #B2B #TechFluencer@EvanKirstel
    Patch

    Cisco's internal review of IOS XR produced two 9.8 criticals and a bundled fix release Cisco's security review of IOS XR found CVE-2026-20274 and CVE-2026-20279, both CVSS 9.8, plus three 8.8s, an 8.6 and an 8.2, all rolled into fixed releases Cisco strongly recommends. Separately, CVE-2026-20212 allows unauthenticated remote root on ten Nexus 9000 switch models through two TCP ports reachable in the default VRF. There is no permanent Nexus fix yet, only infrastructure ACLs. No exploitation has been observed. This is core carrier and data center gear. https://www.theregister.com/security/2026/09/04/cisco-searched-for-ios-xr-bugs-and-found-so-many-it-rolled-them-into-an-update-release/5294410

    Post summary

    Cisco identified multiple critical IOS XR vulnerabilities, released a bundled fix, and noted that while no exploitation has been observed, a temporary ACL workaround is available for Nexus 9000 models.

    00000850
    386.1K followersView on X
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #schwachstellen Cisco IOS XR: Kritische Schwachstelle CVE-2026-20274 aus interner Prüfung entdeckt #cisco #ciscoiosxr #cve202620274 #cwe664 https://cybersecurity-news.de/cisco-ios-xr-cve-2026-20274-kritische-schwachstelle

    Post summary

    An internal review discovered a critical vulnerability in Cisco IOS XR (CVE-2026-20274) and publicly announced the finding, but no additional technical details or remediation information were provided.

    0000060
    10 followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    🚨 CRITICAL — CVE-2026-20274 Cisco IOS XR Software Security Hardening Release: September 2026 CVSS 9.8 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-20274 #Cisco #CyberSecurity #InfoSec

    Post summary

    Critical CVE-2026-20274 disclosed with a CVSS score of 9.8, no patch available yet, and a link to a full analysis is provided.

    0000068
    83 followersView on X
CPE platform detail111 entries

111 of 111 entries

PartVendorProductVersionTarget SWTarget HW
OSciscoios_xr24.1.1--
OSciscoios_xr24.1.2--
OSciscoios_xr24.2.1--
OSciscoios_xr24.2.11--
OSciscoios_xr24.2.2--
OSciscoios_xr24.2.20--
OSciscoios_xr24.2.21--
OSciscoios_xr24.3.1--
OSciscoios_xr24.3.2--
OSciscoios_xr24.3.20--
OSciscoios_xr24.3.30--
OSciscoios_xr24.4.1--
OSciscoios_xr24.4.10--
OSciscoios_xr24.4.15--
OSciscoios_xr24.4.2--
OSciscoios_xr24.4.30--
OSciscoios_xr25.1.1--
OSciscoios_xr25.1.2--
OSciscoios_xr25.1.30--
OSciscoios_xr25.2.1--
OSciscoios_xr25.2.15--
OSciscoios_xr25.2.2--
OSciscoios_xr25.2.30--
OSciscoios_xr25.3.1--
OSciscoios_xr25.3.15--
OSciscoios_xr25.4.1--
OSciscoios_xr25.4.2--
OSciscoios_xr25.4.201--
OSciscoios_xr25.4.30--
OSciscoios_xr26.1.1--
OSciscoios_xr26.1.2--
OSciscoios_xr26.2.1--
OSciscoios_xr26.2.100--
OSciscoios_xr26.2.101--
OSciscoios_xr6.5.25--
OSciscoios_xr6.5.26--
OSciscoios_xr6.5.28--
OSciscoios_xr6.5.29--
OSciscoios_xr6.5.31--
OSciscoios_xr6.5.32--
OSciscoios_xr6.5.33--
OSciscoios_xr6.5.35--
OSciscoios_xr6.5.351--
OSciscoios_xr6.5.352--
OSciscoios_xr6.5.353--
OSciscoios_xr6.5.90--
OSciscoios_xr6.7.1--
OSciscoios_xr6.7.2--
OSciscoios_xr6.7.3--
OSciscoios_xr6.7.35--
OSciscoios_xr6.7.4--
OSciscoios_xr6.8.1--
OSciscoios_xr6.8.2--
OSciscoios_xr6.9.1--
OSciscoios_xr6.9.2--
OSciscoios_xr7.0.0--
OSciscoios_xr7.0.1--
OSciscoios_xr7.0.11--
OSciscoios_xr7.0.12--
OSciscoios_xr7.0.14--
OSciscoios_xr7.0.2--
OSciscoios_xr7.0.90--
OSciscoios_xr7.1.1--
OSciscoios_xr7.1.15--
OSciscoios_xr7.1.2--
OSciscoios_xr7.1.25--
OSciscoios_xr7.1.3--
OSciscoios_xr7.10.1--
OSciscoios_xr7.10.2--
OSciscoios_xr7.11.1--
OSciscoios_xr7.11.2--
OSciscoios_xr7.11.21--
OSciscoios_xr7.2.0--
OSciscoios_xr7.2.1--
OSciscoios_xr7.2.12--
OSciscoios_xr7.2.2--
OSciscoios_xr7.3.1--
OSciscoios_xr7.3.15--
OSciscoios_xr7.3.16--
OSciscoios_xr7.3.2--
OSciscoios_xr7.3.27--
OSciscoios_xr7.3.3--
OSciscoios_xr7.3.4--
OSciscoios_xr7.3.5--
OSciscoios_xr7.3.6--
OSciscoios_xr7.4.1--
OSciscoios_xr7.4.15--
OSciscoios_xr7.4.16--
OSciscoios_xr7.4.2--
OSciscoios_xr7.5.1--
OSciscoios_xr7.5.12--
OSciscoios_xr7.5.2--
OSciscoios_xr7.5.3--
OSciscoios_xr7.5.4--
OSciscoios_xr7.5.5--
OSciscoios_xr7.5.52--
OSciscoios_xr7.6.1--
OSciscoios_xr7.6.15--
OSciscoios_xr7.6.2--
OSciscoios_xr7.6.3--
OSciscoios_xr7.7.1--
OSciscoios_xr7.7.2--
OSciscoios_xr7.7.21--
OSciscoios_xr7.8.1--
OSciscoios_xr7.8.12--
OSciscoios_xr7.8.2--
OSciscoios_xr7.8.22--
OSciscoios_xr7.8.23--
OSciscoios_xr7.9.1--
OSciscoios_xr7.9.2--
OSciscoios_xr7.9.21--

Explore more

Back to dashboardcisco CVEsios_xr vulnerabilities