CVE-2026-20118

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20118", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.376Z", "datePublished": "2026-03-11T16:31:32.117Z", "dateUpdated": "2026-03-11T17:20:21.023Z"}, "containers": {"cna": {"title": "Cisco IOS-XR NCS 5500 and NCS 5700 Egress Packet Network Interfaces Aligner Interrupt Denial of Service Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in the handling of an Egress Packet Network Interface (EPNI) Aligner interrupt in Cisco IOS XR Software for Cisco Network Convergence System (NCS) 5500 Series with NC57 line cards and Cisco NCS 5700 Routers and Cisco IOS XR Software for Third Party Software could allow an unauthenticated, remote attacker to cause the network processing unit (NPU) and ASIC to stop processing, preventing traffic from traversing the interface.\r\n\r\nThis vulnerability is due to the corruption of packets in specific cases when an EPNI Aligner interrupt is triggered while an affected device is experiencing heavy transit traffic. An attacker could exploit this vulnerability by sending a continuous flow of crafted packets to an interface of the affected device. A successful exploit could allow the attacker to cause persistent, heavy packet loss, resulting in a denial of service (DoS) condition.\r\nNote: If active exploitation of this vulnerability is suspected, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider.\r\nCisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. This change was made because the affected device operates within a critical network segment where compromise could lead to significant disruption or exposure, thereby elevating the overall risk beyond the base technical severity."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrncs-epni-int-dos-TWMffUsN", "name": "cisco-sa-xrncs-epni-int-dos-TWMffUsN"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-xrncs-epni-int-dos-TWMffUsN", "discovery": "EXTERNAL", "defects": ["CSCws66900"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Cleanup on Thrown Exception", "type": "cwe", "cweId": "CWE-460"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XR Software", "versions": [{"version": "7.9.1", "status": "affected"}, {"version": "7.10.1", "status": "affected"}, {"version": "7.9.2", "status": "affected"}, {"version": "7.11.1", "status": "affected"}, {"version": "7.10.2", "status": "affected"}, {"version": "24.1.1", "status": "affected"}, {"version": "7.11.2", "status": "affected"}, {"version": "24.2.1", "status": "affected"}, {"version": "24.1.2", "status": "affected"}, {"version": "24.3.1", "status": "affected"}, {"version": "24.4.1", "status": "affected"}, {"version": "24.2.11", "status": "affected"}, {"version": "24.2.2", "status": "affected"}, {"version": "7.11.21", "status": "affected"}, {"version": "24.2.20", "status": "affected"}, {"version": "24.3.2", "status": "affected"}, {"version": "25.1.1", "status": "affected"}, {"version": "24.3.20", "status": "affected"}, {"version": "24.4.2", "status": "affected"}, {"version": "25.1.2", "status": "affected"}, {"version": "24.3.30", "status": "affected"}, {"version": "24.4.30", "status": "affected"}, {"version": "24.2.21", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-11T16:31:32.117Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20118", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T17:05:28.107036Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T17:20:21.023Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20118", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T17:05:28.107036Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T17:14:18.373Z"}}], "cna": {"title": "Cisco IOS-XR NCS 5500 and NCS 5700 Egress Packet Network Interfaces Aligner Interrupt Denial of Service Vulnerability", "source": {"defects": ["CSCws66900"], "advisory": "cisco-sa-xrncs-epni-int-dos-TWMffUsN", "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XR Software", "versions": [{"status": "affected", "version": "7.9.1"}, {"status": "affected", "version": "7.10.1"}, {"status": "affected", "version": "7.9.2"}, {"status": "affected", "version": "7.11.1"}, {"status": "affected", "version": "7.10.2"}, {"status": "affected", "version": "24.1.1"}, {"status": "affected", "version": "7.11.2"}, {"status": "affected", "version": "24.2.1"}, {"status": "affected", "version": "24.1.2"}, {"status": "affected", "version": "24.3.1"}, {"status": "affected", "version": "24.4.1"}, {"status": "affected", "version": "24.2.11"}, {"status": "affected", "version": "24.2.2"}, {"status": "affected", "version": "7.11.21"}, {"status": "affected", "version": "24.2.20"}, {"status": "affected", "version": "24.3.2"}, {"status": "affected", "version": "25.1.1"}, {"status": "affected", "version": "24.3.20"}, {"status": "affected", "version": "24.4.2"}, {"status": "affected", "version": "25.1.2"}, {"status": "affected", "version": "24.3.30"}, {"status": "affected", "version": "24.4.30"}, {"status": "affected", "version": "24.2.21"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrncs-epni-int-dos-TWMffUsN", "name": "cisco-sa-xrncs-epni-int-dos-TWMffUsN"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the handling of an Egress Packet Network Interface (EPNI) Aligner interrupt in Cisco IOS XR Software for Cisco Network Convergence System (NCS) 5500 Series with NC57 line cards and Cisco NCS 5700 Routers and Cisco IOS XR Software for Third Party Software could allow an unauthenticated, remote attacker to cause the network processing unit (NPU) and ASIC to stop processing, preventing traffic from traversing the interface.\r\n\r\nThis vulnerability is due to the corruption of packets in specific cases when an EPNI Aligner interrupt is triggered while an affected device is experiencing heavy transit traffic. An attacker could exploit this vulnerability by sending a continuous flow of crafted packets to an interface of the affected device. A successful exploit could allow the attacker to cause persistent, heavy packet loss, resulting in a denial of service (DoS) condition.\r\nNote: If active exploitation of this vulnerability is suspected, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider.\r\nCisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. This change was made because the affected device operates within a critical network segment where compromise could lead to significant disruption or exposure, thereby elevating the overall risk beyond the base technical severity."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-460", "description": "Improper Cleanup on Thrown Exception"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-11T16:31:32.117Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20118", "state": "PUBLISHED", "dateUpdated": "2026-03-11T17:20:21.023Z", "dateReserved": "2025-10-08T11:59:15.376Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-03-11T16:31:32.117Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Cisco IOS XR Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "7.9.1"}, {"status": "affected", "version": "7.10.1"}, {"status": "affected", "version": "7.9.2"}, {"status": "affected", "version": "7.11.1"}, {"status": "affected", "version": "7.10.2"}, {"status": "affected", "version": "24.1.1"}, {"status": "affected", "version": "7.11.2"}, {"status": "affected", "version": "24.2.1"}, {"status": "affected", "version": "24.1.2"}, {"status": "affected", "version": "24.3.1"}, {"status": "affected", "version": "24.4.1"}, {"status": "affected", "version": "24.2.11"}, {"status": "affected", "version": "24.2.2"}, {"status": "affected", "version": "7.11.21"}, {"status": "affected", "version": "24.2.20"}, {"status": "affected", "version": "24.3.2"}, {"status": "affected", "version": "25.1.1"}, {"status": "affected", "version": "24.3.20"}, {"status": "affected", "version": "24.4.2"}, {"status": "affected", "version": "25.1.2"}, {"status": "affected", "version": "24.3.30"}, {"status": "affected", "version": "24.4.30"}, {"status": "affected", "version": "24.2.21"}]}], "source": "psirt@cisco.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the handling of an Egress Packet Network Interface (EPNI) Aligner interrupt in Cisco IOS XR Software for Cisco Network Convergence System (NCS) 5500 Series with NC57 line cards and Cisco NCS 5700 Routers and Cisco IOS XR Software for Third Party Software could allow an unauthenticated, remote attacker to cause the network processing unit (NPU) and ASIC to stop processing, preventing traffic from traversing the interface.\r\n\r\nThis vulnerability is due to the corruption of packets in specific cases when an EPNI Aligner interrupt is triggered while an affected device is experiencing heavy transit traffic. An attacker could exploit this vulnerability by sending a continuous flow of crafted packets to an interface of the affected device. A successful exploit could allow the attacker to cause persistent, heavy packet loss, resulting in a denial of service (DoS) condition.\r\nNote: If active exploitation of this vulnerability is suspected, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider.\r\nCisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. This change was made because the affected device operates within a critical network segment where compromise could lead to significant disruption or exposure, thereby elevating the overall risk beyond the base technical severity."}, {"lang": "es", "value": "Una vulnerabilidad en el manejo de una interrupci\u00f3n del alineador de la interfaz de red de paquetes de salida (EPNI) en el software Cisco IOS XR para las series Cisco Network Convergence System (NCS) 5500 con tarjetas de l\u00ednea NC57 y los routers Cisco NCS 5700 y el software Cisco IOS XR para software de terceros podr\u00eda permitir a un atacante remoto no autenticado que la unidad de procesamiento de red (NPU) y el ASIC dejen de procesar, impidiendo que el tr\u00e1fico atraviese la interfaz.\n\nEsta vulnerabilidad se debe a la corrupci\u00f3n de paquetes en casos espec\u00edficos cuando se activa una interrupci\u00f3n del alineador EPNI mientras un dispositivo afectado experimenta un tr\u00e1fico de tr\u00e1nsito intenso. Un atacante podr\u00eda explotar esta vulnerabilidad enviando un flujo continuo de paquetes manipulados a una interfaz del dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante causar una p\u00e9rdida de paquetes persistente e intensa, lo que resultar\u00eda en una condici\u00f3n de denegaci\u00f3n de servicio (DoS).\nNota: Si se sospecha de una explotaci\u00f3n activa de esta vulnerabilidad, p\u00f3ngase en contacto con el Centro de Asistencia T\u00e9cnica (TAC) de Cisco o con su proveedor de mantenimiento contratado.\nCisco ha asignado a este aviso de seguridad una Calificaci\u00f3n de Impacto de Seguridad (SIR) de Alta en lugar de Media, como indica la puntuaci\u00f3n. Este cambio se realiz\u00f3 porque el dispositivo afectado opera dentro de un segmento de red cr\u00edtico donde un compromiso podr\u00eda provocar una interrupci\u00f3n o exposici\u00f3n significativa, elevando as\u00ed el riesgo general m\u00e1s all\u00e1 de la gravedad t\u00e9cnica base."}], "id": "CVE-2026-20118", "lastModified": "2026-06-17T10:17:08.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.0, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20118", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T17:05:28.107036Z", "version": "2.0.3"}}]}, "published": "2026-03-11T17:16:56.223", "references": [{"source": "psirt@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrncs-epni-int-dos-TWMffUsN"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-460"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.9.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.10.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.9.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.11.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.10.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.11.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.2.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.11.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.2.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.3.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.3.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.3.30"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.4.30"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.2.21"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Cisco IOS XR Software", "source": "cna", "vendor": "Cisco"}, "product": "ios_xr_software", "vendor": "cisco"}], "analysis": {"en": {"generated_at": "2026-03-17T15:08:50.553318+00:00", "value": {"mitigation_remediation": ["Apply any Cisco IOS XR Software patch or update that addresses the EPNI Aligner interrupt issue. (If a patch is not yet available, coordinate with Cisco TAC for guidance.)", "If a patch is not yet released, consider operator\u2011level mitigations such as limiting or throttling traffic on the affected interfaces to reduce heavy transit load, or invoke any documented workarounds in the Cisco advisory.", "Monitor the interface for signs of excessive packet loss, NPU/ASIC stalls, or service interruptions.", "Contact Cisco TAC or your maintenance provider immediately if you suspect active exploitation.", "Refer to the Cisco security advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrncs-epni-int-dos-TWMffUsN) for detailed guidance."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected products are Cisco IOS XR Software running on Cisco Network Convergence System 5500 Series with NC57 line cards and Cisco NCS 5700 routers, as well as any third\u2011party software compiled for IOS XR. Specific version numbers are not provided in the advisory, so any installation of the listed platforms that incorporates the vulnerable EPNI handling code remains potentially susceptible.", "description_and_impact": "The vulnerability is in the handling of an Egress Packet Network Interface (EPNI) Aligner interrupt in Cisco IOS XR Software. Corruption of packets during this interrupt can cause the network processing unit (NPU) and ASIC to stop processing, thereby preventing traffic from traversing the affected interface. This results in a persistent, heavy packet loss that manifests as a denial of service. The weakness is identified as CWE\u2011460, reflecting a violation of expected operating conditions.", "risk_and_exploitability": "According to the advisory, the CVSS score is 6.8 and the EPSS probability is less than 1\u202f%. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated remote attacker to send a continuous flow of crafted packets to the affected interface while the device is under heavy transit traffic; the attacker can then force the NPU/ASIC to halt processing. The likely attack vector is remote network traffic, inferred from the requirement to transmit specially crafted packets to the vulnerable interface. The overall risk is considered high by Cisco because the device operates in a critical network segment."}}}}, "created": "2026-03-12T09:57:48.193840+00:00", "updated": "2026-03-20T15:30:27.444595+00:00", "vendors": ["cisco", "cisco$PRODUCT$ios_xr_software"]}