CVE-2026-20086

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20086", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.367Z", "datePublished": "2026-03-25T16:02:55.912Z", "dateUpdated": "2026-03-26T17:40:42.427Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-25T16:02:55.912Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r This vulnerability is due to improper handling of a malformed CAPWAP packet. An attacker could exploit this vulnerability by sending a malformed CAPWAP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition."}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"version": "17.14.1", "status": "affected"}, {"version": "17.15.1", "status": "affected"}, {"version": "17.15.2", "status": "affected"}, {"version": "17.15.3", "status": "affected"}, {"version": "17.15.2b", "status": "affected"}, {"version": "17.15.4", "status": "affected"}, {"version": "17.15.4d", "status": "affected"}, {"version": "17.16.1", "status": "affected"}, {"version": "17.17.1", "status": "affected"}, {"version": "17.18.1", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Handling of Missing Values", "type": "cwe", "cweId": "CWE-230"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-dos-hnX5KGOm", "name": "cisco-sa-wlc-dos-hnX5KGOm"}], "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-wlc-dos-hnX5KGOm", "discovery": "EXTERNAL", "defects": ["CSCwp13209"]}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T17:40:31.927726Z", "id": "CVE-2026-20086", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T17:40:42.427Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20086", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T17:40:31.927726Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T17:40:38.380Z"}}], "cna": {"source": {"defects": ["CSCwp13209"], "advisory": "cisco-sa-wlc-dos-hnX5KGOm", "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"status": "affected", "version": "17.14.1"}, {"status": "affected", "version": "17.15.1"}, {"status": "affected", "version": "17.15.2"}, {"status": "affected", "version": "17.15.3"}, {"status": "affected", "version": "17.15.2b"}, {"status": "affected", "version": "17.15.4"}, {"status": "affected", "version": "17.15.4d"}, {"status": "affected", "version": "17.16.1"}, {"status": "affected", "version": "17.17.1"}, {"status": "affected", "version": "17.18.1"}]}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-dos-hnX5KGOm", "name": "cisco-sa-wlc-dos-hnX5KGOm"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r This vulnerability is due to improper handling of a malformed CAPWAP packet. An attacker could exploit this vulnerability by sending a malformed CAPWAP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-230", "description": "Improper Handling of Missing Values"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-25T16:02:55.912Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20086", "state": "PUBLISHED", "dateUpdated": "2026-03-26T17:40:42.427Z", "dateReserved": "2025-10-08T11:59:15.367Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-03-25T16:02:55.912Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Cisco IOS XE Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "17.14.1"}, {"status": "affected", "version": "17.15.1"}, {"status": "affected", "version": "17.15.2"}, {"status": "affected", "version": "17.15.3"}, {"status": "affected", "version": "17.15.2b"}, {"status": "affected", "version": "17.15.4"}, {"status": "affected", "version": "17.15.4d"}, {"status": "affected", "version": "17.16.1"}, {"status": "affected", "version": "17.17.1"}, {"status": "affected", "version": "17.18.1"}]}], "source": "psirt@cisco.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r This vulnerability is due to improper handling of a malformed CAPWAP packet. An attacker could exploit this vulnerability by sending a malformed CAPWAP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition."}, {"lang": "es", "value": "Una vulnerabilidad en el procesamiento de paquetes de Control y Aprovisionamiento de Puntos de Acceso Inal\u00e1mbricos (CAPWAP) de Cisco IOS XE Wireless Controller Software para la familia Catalyst CW9800 podr\u00eda permitir a un atacante remoto no autenticado causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en un dispositivo afectado. Esta vulnerabilidad se debe a un manejo inadecuado de un paquete CAPWAP malformado. Un atacante podr\u00eda explotar esta vulnerabilidad enviando un paquete CAPWAP malformado a un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante causar que el dispositivo afectado se reinicie inesperadamente, lo que resultar\u00eda en una condici\u00f3n de DoS."}], "id": "CVE-2026-20086", "lastModified": "2026-06-17T10:17:03.503", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20086", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T17:40:31.927726Z", "version": "2.0.3"}}]}, "published": "2026-03-25T16:16:13.920", "references": [{"source": "psirt@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-dos-hnX5KGOm"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-230"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.14.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.15.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.15.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.15.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.15.2b"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.15.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.15.4d"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.16.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.17.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.18.1"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Cisco IOS XE Software", "source": "cna", "vendor": "Cisco"}, "product": "ios_xe_software", "vendor": "cisco"}], "analysis": {"en": {"generated_at": "2026-03-25T19:35:03.007041+00:00", "value": {"mitigation_remediation": ["Apply the Cisco IOS\u00a0XE software update that addresses this CAPWAP packet parsing issue. ", "Please refer to Cisco\u2019s security advisory for download links and deployment guidance. ", "As a temporary measure, restrict CAPWAP traffic to trusted IP addresses using firewall or ACL rules to reduce exposure. ", "Continuously monitor controller logs for unexpected reloads and other abnormal events. ", "Keep the wireless controller firmware and associated network equipment up to date with the latest security patches."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The flaw affects Cisco IOS\u00a0XE Wireless Controller Software deployed on Catalyst\u00a0CW9800 wireless controllers. No specific software versions are listed in the advisory, so all deployments of this controller family running the vulnerable software are potentially exposed.", "description_and_impact": "A malformed CAPWAP packet can be sent to a Cisco IOS\u00a0XE Wireless Controller (Catalyst\u00a0CW9800 Family) by an unauthenticated remote attacker. The improper parsing of such packets causes the device to reload unexpectedly, resulting in a denial of service. This weakness is categorized as CWE\u2011230, reflecting improper input validation that leads to system destabilization.", "risk_and_exploitability": "The vulnerability is scored CVSS\u20098.6, indicating high severity, and it is not yet listed in the CISA KEV catalog. Because the attack vector is remote and requires no authentication, the likelihood of exploitation is significant in environments where the controller is accessible over a network. The lack of known mitigation steps in the advisory suggests that a vendor patch is the preferred response."}}}}, "created": "2026-03-25T21:30:57.358023+00:00", "title": "Remote Denial of Service via Malformed CAPWAP Packet on Cisco IOS XE Wireless Controller", "updated": "2026-03-26T11:42:48.882296+00:00", "vendors": ["cisco", "cisco$PRODUCT$ios_xe_software"]}