CVE-2026-20046

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20046", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.354Z", "datePublished": "2026-03-11T16:31:18.318Z", "dateUpdated": "2026-03-12T03:55:36.546Z"}, "containers": {"cna": {"title": "Cisco IOS XR Software CLI Privilege Escalation Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device.\r\n\r\nThis vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W", "name": "cisco-sa-iosxr-privesc-bF8D5U4W"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-iosxr-privesc-bF8D5U4W", "discovery": "INTERNAL", "defects": ["CSCwp87543"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Permissions, Privileges, and Access Control", "type": "cwe", "cweId": "CWE-264"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XR Software", "versions": [{"version": "6.6.1", "status": "affected"}, {"version": "6.5.3", "status": "affected"}, {"version": "7.0.1", "status": "affected"}, {"version": "6.5.1", "status": "affected"}, {"version": "6.5.2", "status": "affected"}, {"version": "6.6.2", "status": "affected"}, {"version": "6.6.25", "status": "affected"}, {"version": "7.1.1", "status": "affected"}, {"version": "7.0.90", "status": "affected"}, {"version": "6.6.3", "status": "affected"}, {"version": "7.0.2", "status": "affected"}, {"version": "7.1.2", "status": "affected"}, {"version": "7.2.1", "status": "affected"}, {"version": "6.6.4", "status": "affected"}, {"version": "7.3.1", "status": "affected"}, {"version": "7.4.1", "status": "affected"}, {"version": "7.2.2", "status": "affected"}, {"version": "7.3.2", "status": "affected"}, {"version": "7.5.1", "status": "affected"}, {"version": "7.6.1", "status": "affected"}, {"version": "7.5.2", "status": "affected"}, {"version": "7.3.4", "status": "affected"}, {"version": "7.3.3", "status": "affected"}, {"version": "7.4.2", "status": "affected"}, {"version": "7.7.1", "status": "affected"}, {"version": "7.6.2", "status": "affected"}, {"version": "7.8.1", "status": "affected"}, {"version": "7.7.2", "status": "affected"}, {"version": "7.9.1", "status": "affected"}, {"version": "7.8.2", "status": "affected"}, {"version": "7.5.4", "status": "affected"}, {"version": "7.8.22", "status": "affected"}, {"version": "7.10.1", "status": "affected"}, {"version": "7.7.21", "status": "affected"}, {"version": "7.9.2", "status": "affected"}, {"version": "7.5.5", "status": "affected"}, {"version": "7.11.1", "status": "affected"}, {"version": "7.10.2", "status": "affected"}, {"version": "7.3.6", "status": "affected"}, {"version": "24.1.1", "status": "affected"}, {"version": "7.11.2", "status": "affected"}, {"version": "24.2.1", "status": "affected"}, {"version": "24.1.2", "status": "affected"}, {"version": "24.3.1", "status": "affected"}, {"version": "24.4.1", "status": "affected"}, {"version": "24.2.2", "status": "affected"}, {"version": "7.11.21", "status": "affected"}, {"version": "24.2.20", "status": "affected"}, {"version": "24.3.2", "status": "affected"}, {"version": "24.4.2", "status": "affected"}, {"version": "25.1.1", "status": "affected"}, {"version": "24.3.20", "status": "affected"}, {"version": "25.2.1", "status": "affected"}, {"version": "25.1.2", "status": "affected"}, {"version": "24.3.30", "status": "affected"}, {"version": "24.2.21", "status": "affected"}, {"version": "25.1.30", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-11T16:31:18.318Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-20046"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T03:55:36.546Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20046", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T17:03:43.322668Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T17:14:22.897Z"}}], "cna": {"title": "Cisco IOS XR Software CLI Privilege Escalation Vulnerability", "source": {"defects": ["CSCwp87543"], "advisory": "cisco-sa-iosxr-privesc-bF8D5U4W", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XR Software", "versions": [{"status": "affected", "version": "6.6.1"}, {"status": "affected", "version": "6.5.3"}, {"status": "affected", "version": "7.0.1"}, {"status": "affected", "version": "6.5.1"}, {"status": "affected", "version": "6.5.2"}, {"status": "affected", "version": "6.6.2"}, {"status": "affected", "version": "6.6.25"}, {"status": "affected", "version": "7.1.1"}, {"status": "affected", "version": "7.0.90"}, {"status": "affected", "version": "6.6.3"}, {"status": "affected", "version": "7.0.2"}, {"status": "affected", "version": "7.1.2"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "6.6.4"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "7.3.2"}, {"status": "affected", "version": "7.5.1"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.5.2"}, {"status": "affected", "version": "7.3.4"}, {"status": "affected", "version": "7.3.3"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.7.1"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.8.1"}, {"status": "affected", "version": "7.7.2"}, {"status": "affected", "version": "7.9.1"}, {"status": "affected", "version": "7.8.2"}, {"status": "affected", "version": "7.5.4"}, {"status": "affected", "version": "7.8.22"}, {"status": "affected", "version": "7.10.1"}, {"status": "affected", "version": "7.7.21"}, {"status": "affected", "version": "7.9.2"}, {"status": "affected", "version": "7.5.5"}, {"status": "affected", "version": "7.11.1"}, {"status": "affected", "version": "7.10.2"}, {"status": "affected", "version": "7.3.6"}, {"status": "affected", "version": "24.1.1"}, {"status": "affected", "version": "7.11.2"}, {"status": "affected", "version": "24.2.1"}, {"status": "affected", "version": "24.1.2"}, {"status": "affected", "version": "24.3.1"}, {"status": "affected", "version": "24.4.1"}, {"status": "affected", "version": "24.2.2"}, {"status": "affected", "version": "7.11.21"}, {"status": "affected", "version": "24.2.20"}, {"status": "affected", "version": "24.3.2"}, {"status": "affected", "version": "24.4.2"}, {"status": "affected", "version": "25.1.1"}, {"status": "affected", "version": "24.3.20"}, {"status": "affected", "version": "25.2.1"}, {"status": "affected", "version": "25.1.2"}, {"status": "affected", "version": "24.3.30"}, {"status": "affected", "version": "24.2.21"}, {"status": "affected", "version": "25.1.30"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W", "name": "cisco-sa-iosxr-privesc-bF8D5U4W"}], "descriptions": [{"lang": "en", "value": "A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device.\r\n\r\nThis vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-264", "description": "Permissions, Privileges, and Access Control"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-11T16:31:18.318Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20046", "state": "PUBLISHED", "dateUpdated": "2026-03-12T03:55:36.546Z", "dateReserved": "2025-10-08T11:59:15.354Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-03-11T16:31:18.318Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Cisco IOS XR Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "6.6.1"}, {"status": "affected", "version": "6.5.3"}, {"status": "affected", "version": "7.0.1"}, {"status": "affected", "version": "6.5.1"}, {"status": "affected", "version": "6.5.2"}, {"status": "affected", "version": "6.6.2"}, {"status": "affected", "version": "6.6.25"}, {"status": "affected", "version": "7.1.1"}, {"status": "affected", "version": "7.0.90"}, {"status": "affected", "version": "6.6.3"}, {"status": "affected", "version": "7.0.2"}, {"status": "affected", "version": "7.1.2"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "6.6.4"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "7.3.2"}, {"status": "affected", "version": "7.5.1"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.5.2"}, {"status": "affected", "version": "7.3.4"}, {"status": "affected", "version": "7.3.3"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.7.1"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.8.1"}, {"status": "affected", "version": "7.7.2"}, {"status": "affected", "version": "7.9.1"}, {"status": "affected", "version": "7.8.2"}, {"status": "affected", "version": "7.5.4"}, {"status": "affected", "version": "7.8.22"}, {"status": "affected", "version": "7.10.1"}, {"status": "affected", "version": "7.7.21"}, {"status": "affected", "version": "7.9.2"}, {"status": "affected", "version": "7.5.5"}, {"status": "affected", "version": "7.11.1"}, {"status": "affected", "version": "7.10.2"}, {"status": "affected", "version": "7.3.6"}, {"status": "affected", "version": "24.1.1"}, {"status": "affected", "version": "7.11.2"}, {"status": "affected", "version": "24.2.1"}, {"status": "affected", "version": "24.1.2"}, {"status": "affected", "version": "24.3.1"}, {"status": "affected", "version": "24.4.1"}, {"status": "affected", "version": "24.2.2"}, {"status": "affected", "version": "7.11.21"}, {"status": "affected", "version": "24.2.20"}, {"status": "affected", "version": "24.3.2"}, {"status": "affected", "version": "24.4.2"}, {"status": "affected", "version": "25.1.1"}, {"status": "affected", "version": "24.3.20"}, {"status": "affected", "version": "25.2.1"}, {"status": "affected", "version": "25.1.2"}, {"status": "affected", "version": "24.3.30"}, {"status": "affected", "version": "24.2.21"}, {"status": "affected", "version": "25.1.30"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*", "matchCriteriaId": "D5A5E154-0631-4AEC-8675-7257BABF5086", "versionEndExcluding": "25.2.2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:ios_xrv_9000:-:*:*:*:*:*:*:*", "matchCriteriaId": "EEE98C3E-67E2-43A3-AEA9-1575F2B93A78", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device.\r\n\r\nThis vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks."}, {"lang": "es", "value": "Una vulnerabilidad en la asignaci\u00f3n de grupos de tareas para un comando CLI espec\u00edfico en el software Cisco IOS XR podr\u00eda permitir a un atacante local autenticado elevar privilegios y obtener control administrativo total de un dispositivo afectado.\n\nEsta vulnerabilidad se debe a un mapeo incorrecto de un comando a grupos de tareas dentro del c\u00f3digo fuente. Un atacante con una cuenta de bajos privilegios podr\u00eda explotar esta vulnerabilidad usando el comando CLI para eludir las comprobaciones basadas en grupos de tareas. Un exploit exitoso podr\u00eda permitir al atacante elevar privilegios y realizar acciones en un dispositivo afectado sin comprobaciones de autorizaci\u00f3n."}], "id": "CVE-2026-20046", "lastModified": "2026-07-01T17:10:13.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20046", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-11T17:16:55.230", "references": [{"source": "psirt@cisco.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.6.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.6.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.6.25"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.90"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.6.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.6.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.5.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.8.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.7.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.9.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.8.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.5.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.8.22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.10.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.7.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.9.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.5.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.11.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.10.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.11.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.11.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.2.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.3.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.3.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.3.30"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.2.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.1.30"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Cisco IOS XR Software", "source": "cna", "vendor": "Cisco"}, "product": "ios_xr_software", "vendor": "cisco"}], "analysis": {"en": {"generated_at": "2026-03-17T15:28:13.961817+00:00", "value": {"mitigation_remediation": ["Apply the latest Cisco IOS XR Software patch that addresses this privilege escalation issue, as detailed in the Cisco security advisory linked above.", "If a patch cannot be applied immediately, restrict the vulnerable CLI command so that it is executable only by privileged or administrative accounts, or disable the command for low\u2011privilege users.", "Monitor device logs for unauthorized or suspicious use of privileged commands and investigate any anomalies.", "Contact Cisco support for additional guidance or to confirm that the device has been fully secured."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The affected product is Cisco IOS XR Software. Version information is not explicitly provided in the CVE entry; users should consult the linked Cisco advisory for details on which releases are impacted.", "description_and_impact": "The vulnerability arises from an incorrect mapping of a command to task groups within Cisco IOS XR Software, classifying it as a privilege management flaw (CWE-264). An authenticated local attacker with a low\u2011privileged account can invoke a specific CLI command to bypass the task\u2011group based access checks and elevate their privileges to full administrative control. The impact is the ability for the attacker to execute any privileged operation that would normally require higher authorization, effectively compromising the confidentiality, integrity, and availability of the device. Based on the description, it is inferred that these core security properties are at risk because the attacker gains unrestricted control over the device.", "risk_and_exploitability": "The issue carries a CVSS v3.1 score of 8.8, indicating high severity, while the EPSS score is below 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local authenticated access via the CLI, so an attacker must already possess some level of user presence on the device. Although the likelihood of exploitation is low, the high impact warrants careful assessment for critical environments where low\u2011privilege accounts exist."}}}}, "created": "2026-03-12T09:57:50.983238+00:00", "updated": "2026-03-20T15:30:30.232385+00:00", "vendors": ["cisco", "cisco$PRODUCT$ios_xr_software"]}