Vulnerability details

CVE-2026-20074

Cisco IOS XR Software

Cisco IOS XR Software Multi-Instance Intermediate System-to-Intermediate System Denial of Service Vulnerability

CVSS 3.1
7.4High

Official description

A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) multi-instance routing feature of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the IS-IS process to restart unexpectedly. This vulnerability is due to insufficient input validation of ingress IS-IS packets. An attacker could exploit this vulnerability by sending crafted IS-IS packets to an affected device after forming an adjacency. A successful exploit could allow the attacker to cause the IS-IS process to restart unexpectedly, resulting in a temporary loss of connectivity to advertised networks and a denial of service (DoS) condition. Note: The IS-IS protocol is a routing protocol. To exploit this vulnerability, an attacker must be Layer 2-adjacent to the affected device and must have formed an adjacency.  

CVSS scores

ScoreVersionSourceVector
7.4High 3.1 CVEProject cvelistV5 (CNA) (cisco) CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected products

VendorProductVersionsSource
Cisco Cisco IOS XR Software 24.1.1 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.1.2 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.2.1 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.2.11 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.2.2 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.2.20 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.2.21 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.3.1 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.3.2 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.3.20 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.3.30 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.4.1 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.4.10 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.4.15 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.4.2 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 24.4.30 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 25.1.1 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 25.1.2 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 25.2.1 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 25.2.15 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 7.10.1 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 7.10.2 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 7.11.1 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 7.11.2 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 7.11.21 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 7.8.1 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 7.8.2 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 7.8.22 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 7.8.23 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 7.9.1 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 7.9.2 CVEProject cvelistV5 (CNA)
Cisco Cisco IOS XR Software 7.9.21 CVEProject cvelistV5 (CNA)

References and advisories

1
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-03-11
Last updated
2026-03-11
State
Published
Assigner (CNA)
cisco

Exploit prediction (EPSS)

0.17%
Probability of exploitation in 30 days
7.4%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
None
Technical impact
Partial

Weaknesses (CWE)

  • CWE-1287
    Improper Validation of Specified Type of Input