CVE-2026-20277

highpriority · track · 33EPSS 0.002 · 13 %ileNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.23% (13th) EPSS

CVSS 8.2 · high

Is it mine?

28 products

Check your exposure

Who says so?

2 sources

fstec_bdu · ncsc_nl

EPSS · scored 2026-10-21

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20277 are related to protection mechanism failure issues that are grouped under the Common Weakness Enumeration (CWE) CWE-693.

cvss

Technical severity, 0–10. One row per scoring source.

8.2

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Hprimary · psirt@cisco.com USexploitability 3.9 · impact 4.2

v3.18.2highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-693USCWE-693US

affected products (28)

Products and version ranges known to be affected.

Cisco Systems, Inc. Cisco IOS XR≤ 7.11.21fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 24.2.21fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 24.3.2fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 25.1.2fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 25.2.21fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 25.4.2fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 25.2.2fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 7.9.2fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 7.10.2fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 7.11.2fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 24.1.2fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 24.2.2fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 24.4.2fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 7.3.2fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 7.9.21fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 25.4.1fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 26.1.2fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 26.2.1fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 26.2.2fstec_bduRU
Cisco Systems, Inc. Cisco IOS XR≤ 26.3.1fstec_bduRU

showing 20 of 28

advisories (1)

Vendor and ecosystem advisories describing this.

NCSC-2026-0338Kwetsbaarheden verholpen in Cisco Nexus 9000 Series, IOS XR Software en Secure EmailNL2026-09-03csaf · ncsc_nlNL
Cisco heeft kwetsbaarheden verholpen in Cisco Nexus 9000 Series Switches met Silicon One technologie, Cisco IOS XR Software en Cisco Secure Email.

also known as (1)

Other names and identifiers for this entity.

BDU:2026-14590 fstec_bdu

sources

Which sources assert this record, and when.

fstec_bdu ncsc_nl NVD CVE.org MITRE

published 2026-09-02modified 2026-09-03

references (1) nvd

External citations — patches, advisories, analysis.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan