CVE-2026-20278

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20278", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.403Z", "datePublished": "2026-09-02T16:14:20.216Z", "dateUpdated": "2026-09-18T12:09:59.282Z"}, "containers": {"cna": {"title": "Cisco IOS XR Software Security Hardening Release: September 2026", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "descriptions": [{"lang": "en", "value": "As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20278 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) CWE-707."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM", "name": "cisco-sa-hardening-iosxr-qg64NcM"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-hardening-iosxr-qg64NcM", "discovery": "INTERNAL", "defects": ["CSCwu36622"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization", "type": "cwe", "cweId": "CWE-707"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XR Software", "versions": [{"version": "6.5.29", "status": "affected"}, {"version": "7.0.1", "status": "affected"}, {"version": "6.5.26", "status": "affected"}, {"version": "6.5.25", "status": "affected"}, {"version": "6.5.28", "status": "affected"}, {"version": "6.5.90", "status": "affected"}, {"version": "7.1.1", "status": "affected"}, {"version": "7.0.90", "status": "affected"}, {"version": "6.7.1", "status": "affected"}, {"version": "7.0.2", "status": "affected"}, {"version": "7.1.15", "status": "affected"}, {"version": "7.2.1", "status": "affected"}, {"version": "7.1.2", "status": "affected"}, {"version": "6.7.2", "status": "affected"}, {"version": "7.0.11", "status": "affected"}, {"version": "7.0.12", "status": "affected"}, {"version": "7.0.14", "status": "affected"}, {"version": "7.1.25", "status": "affected"}, {"version": "7.2.12", "status": "affected"}, {"version": "7.3.1", "status": "affected"}, {"version": "7.1.3", "status": "affected"}, {"version": "6.7.3", "status": "affected"}, {"version": "7.4.1", "status": "affected"}, {"version": "7.2.2", "status": "affected"}, {"version": "6.7.4", "status": "affected"}, {"version": "6.5.31", "status": "affected"}, {"version": "7.3.15", "status": "affected"}, {"version": "7.3.16", "status": "affected"}, {"version": "6.8.1", "status": "affected"}, {"version": "7.4.15", "status": "affected"}, {"version": "6.5.32", "status": "affected"}, {"version": "7.3.2", "status": "affected"}, {"version": "7.5.1", "status": "affected"}, {"version": "7.4.16", "status": "affected"}, {"version": "7.3.27", "status": "affected"}, {"version": "7.6.1", "status": "affected"}, {"version": "7.5.2", "status": "affected"}, {"version": "7.8.1", "status": "affected"}, {"version": "7.6.15", "status": "affected"}, {"version": "7.5.12", "status": "affected"}, {"version": "7.8.12", "status": "affected"}, {"version": "7.3.3", "status": "affected"}, {"version": "7.7.1", "status": "affected"}, {"version": "6.8.2", "status": "affected"}, {"version": "7.3.4", "status": "affected"}, {"version": "7.4.2", "status": "affected"}, {"version": "6.7.35", "status": "affected"}, {"version": "6.9.1", "status": "affected"}, {"version": "7.6.2", "status": "affected"}, {"version": "7.5.3", "status": "affected"}, {"version": "7.7.2", "status": "affected"}, {"version": "6.9.2", "status": "affected"}, {"version": "7.9.1", "status": "affected"}, {"version": "7.10.1", "status": "affected"}, {"version": "7.8.2", "status": "affected"}, {"version": "7.5.4", "status": "affected"}, {"version": "6.5.33", "status": "affected"}, {"version": "7.8.22", "status": "affected"}, {"version": "7.7.21", "status": "affected"}, {"version": "7.9.2", "status": "affected"}, {"version": "7.3.5", "status": "affected"}, {"version": "7.5.5", "status": "affected"}, {"version": "7.11.1", "status": "affected"}, {"version": "7.9.21", "status": "affected"}, {"version": "7.10.2", "status": "affected"}, {"version": "24.1.1", "status": "affected"}, {"version": "7.6.3", "status": "affected"}, {"version": "7.3.6", "status": "affected"}, {"version": "7.5.52", "status": "affected"}, {"version": "7.11.2", "status": "affected"}, {"version": "24.2.1", "status": "affected"}, {"version": "24.1.2", "status": "affected"}, {"version": "24.2.11", "status": "affected"}, {"version": "24.3.1", "status": "affected"}, {"version": "24.4.1", "status": "affected"}, {"version": "24.2.2", "status": "affected"}, {"version": "7.8.23", "status": "affected"}, {"version": "7.11.21", "status": "affected"}, {"version": "24.2.20", "status": "affected"}, {"version": "24.3.2", "status": "affected"}, {"version": "24.4.10", "status": "affected"}, {"version": "6.5.35", "status": "affected"}, {"version": "25.1.1", "status": "affected"}, {"version": "24.4.2", "status": "affected"}, {"version": "24.3.20", "status": "affected"}, {"version": "24.4.15", "status": "affected"}, {"version": "25.2.1", "status": "affected"}, {"version": "6.5.351", "status": "affected"}, {"version": "25.1.2", "status": "affected"}, {"version": "24.3.30", "status": "affected"}, {"version": "25.3.1", "status": "affected"}, {"version": "6.5.352", "status": "affected"}, {"version": "24.4.30", "status": "affected"}, {"version": "24.2.21", "status": "affected"}, {"version": "25.4.1", "status": "affected"}, {"version": "25.2.2", "status": "affected"}, {"version": "25.2.15", "status": "affected"}, {"version": "7.2.0", "status": "affected"}, {"version": "7.0.0", "status": "affected"}, {"version": "25.2.30", "status": "affected"}, {"version": "6.5.353", "status": "affected"}, {"version": "26.1.1", "status": "affected"}, {"version": "25.1.30", "status": "affected"}, {"version": "25.3.15", "status": "affected"}, {"version": "26.2.100", "status": "affected"}, {"version": "25.4.2", "status": "affected"}, {"version": "26.2.1", "status": "affected"}, {"version": "25.4.30", "status": "affected"}, {"version": "26.1.2", "status": "affected"}, {"version": "25.4.201", "status": "affected"}, {"version": "26.2.101", "status": "affected"}, {"version": "25.2.21", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-09-18T12:09:59.282Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-02T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-20278"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-03T03:56:26.376Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-15T17:03:58.749Z"}, "descriptions": [{"lang": "en", "value": "The CVE Program recognizes that this CVE Record provides vulnerability information that a Supplier CNA believes is very important to consumers. The CVE Program has flagged this CVE Record as it assigns a single CVE ID to a collection of individual vulnerabilities which does not align with CVE's \"one vulnerability, one ID\" principle, and therefore provides incomplete information. For further clarification, please see the CVE Program's blog, \"Preserving Vulnerability-Level Identification\" linked below. Details within the CNA container below are viewable by clicking on the CNA name."}], "tags": ["x_bundling-flagged-by-CVE-Program"], "references": [{"url": "https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"tags": ["x_bundling-flagged-by-CVE-Program"], "references": [{"url": "https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification"}], "descriptions": [{"lang": "en", "value": "The CVE Program recognizes that this CVE Record provides vulnerability information that a Supplier CNA believes is very important to consumers. The CVE Program has flagged this CVE Record as it assigns a single CVE ID to a collection of individual vulnerabilities which does not align with CVE's \"one vulnerability, one ID\" principle, and therefore provides incomplete information. For further clarification, please see the CVE Program's blog, \"Preserving Vulnerability-Level Identification\" linked below. Details within the CNA container below are viewable by clicking on the CNA name."}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-15T17:03:58.749Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20278", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-02T16:35:47.741318Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-02T17:56:40.447Z"}}], "cna": {"title": "Cisco IOS XR Software Security Hardening Release: September 2026", "source": {"defects": ["CSCwu36622"], "advisory": "cisco-sa-hardening-iosxr-qg64NcM", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XR Software", "versions": [{"status": "affected", "version": "6.5.29"}, {"status": "affected", "version": "7.0.1"}, {"status": "affected", "version": "6.5.26"}, {"status": "affected", "version": "6.5.25"}, {"status": "affected", "version": "6.5.28"}, {"status": "affected", "version": "6.5.90"}, {"status": "affected", "version": "7.1.1"}, {"status": "affected", "version": "7.0.90"}, {"status": "affected", "version": "6.7.1"}, {"status": "affected", "version": "7.0.2"}, {"status": "affected", "version": "7.1.15"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "7.1.2"}, {"status": "affected", "version": "6.7.2"}, {"status": "affected", "version": "7.0.11"}, {"status": "affected", "version": "7.0.12"}, {"status": "affected", "version": "7.0.14"}, {"status": "affected", "version": "7.1.25"}, {"status": "affected", "version": "7.2.12"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.1.3"}, {"status": "affected", "version": "6.7.3"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "6.7.4"}, {"status": "affected", "version": "6.5.31"}, {"status": "affected", "version": "7.3.15"}, {"status": "affected", "version": "7.3.16"}, {"status": "affected", "version": "6.8.1"}, {"status": "affected", "version": "7.4.15"}, {"status": "affected", "version": "6.5.32"}, {"status": "affected", "version": "7.3.2"}, {"status": "affected", "version": "7.5.1"}, {"status": "affected", "version": "7.4.16"}, {"status": "affected", "version": "7.3.27"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.5.2"}, {"status": "affected", "version": "7.8.1"}, {"status": "affected", "version": "7.6.15"}, {"status": "affected", "version": "7.5.12"}, {"status": "affected", "version": "7.8.12"}, {"status": "affected", "version": "7.3.3"}, {"status": "affected", "version": "7.7.1"}, {"status": "affected", "version": "6.8.2"}, {"status": "affected", "version": "7.3.4"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "6.7.35"}, {"status": "affected", "version": "6.9.1"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.5.3"}, {"status": "affected", "version": "7.7.2"}, {"status": "affected", "version": "6.9.2"}, {"status": "affected", "version": "7.9.1"}, {"status": "affected", "version": "7.10.1"}, {"status": "affected", "version": "7.8.2"}, {"status": "affected", "version": "7.5.4"}, {"status": "affected", "version": "6.5.33"}, {"status": "affected", "version": "7.8.22"}, {"status": "affected", "version": "7.7.21"}, {"status": "affected", "version": "7.9.2"}, {"status": "affected", "version": "7.3.5"}, {"status": "affected", "version": "7.5.5"}, {"status": "affected", "version": "7.11.1"}, {"status": "affected", "version": "7.9.21"}, {"status": "affected", "version": "7.10.2"}, {"status": "affected", "version": "24.1.1"}, {"status": "affected", "version": "7.6.3"}, {"status": "affected", "version": "7.3.6"}, {"status": "affected", "version": "7.5.52"}, {"status": "affected", "version": "7.11.2"}, {"status": "affected", "version": "24.2.1"}, {"status": "affected", "version": "24.1.2"}, {"status": "affected", "version": "24.2.11"}, {"status": "affected", "version": "24.3.1"}, {"status": "affected", "version": "24.4.1"}, {"status": "affected", "version": "24.2.2"}, {"status": "affected", "version": "7.8.23"}, {"status": "affected", "version": "7.11.21"}, {"status": "affected", "version": "24.2.20"}, {"status": "affected", "version": "24.3.2"}, {"status": "affected", "version": "24.4.10"}, {"status": "affected", "version": "6.5.35"}, {"status": "affected", "version": "25.1.1"}, {"status": "affected", "version": "24.4.2"}, {"status": "affected", "version": "24.3.20"}, {"status": "affected", "version": "24.4.15"}, {"status": "affected", "version": "25.2.1"}, {"status": "affected", "version": "6.5.351"}, {"status": "affected", "version": "25.1.2"}, {"status": "affected", "version": "24.3.30"}, {"status": "affected", "version": "25.3.1"}, {"status": "affected", "version": "6.5.352"}, {"status": "affected", "version": "24.4.30"}, {"status": "affected", "version": "24.2.21"}, {"status": "affected", "version": "25.4.1"}, {"status": "affected", "version": "25.2.2"}, {"status": "affected", "version": "25.2.15"}, {"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.0.0"}, {"status": "affected", "version": "25.2.30"}, {"status": "affected", "version": "6.5.353"}, {"status": "affected", "version": "26.1.1"}, {"status": "affected", "version": "25.1.30"}, {"status": "affected", "version": "25.3.15"}, {"status": "affected", "version": "26.2.100"}, {"status": "affected", "version": "25.4.2"}, {"status": "affected", "version": "26.2.1"}, {"status": "affected", "version": "25.4.30"}, {"status": "affected", "version": "26.1.2"}, {"status": "affected", "version": "25.4.201"}, {"status": "affected", "version": "26.2.101"}, {"status": "affected", "version": "25.2.21"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM", "name": "cisco-sa-hardening-iosxr-qg64NcM"}], "descriptions": [{"lang": "en", "value": "As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20278 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) CWE-707."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-707", "description": "Improper Neutralization"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-09-18T12:09:59.282Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20278", "state": "PUBLISHED", "dateUpdated": "2026-09-18T12:09:59.282Z", "dateReserved": "2025-10-08T11:59:15.403Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-09-02T16:14:20.216Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Cisco IOS XR Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "6.5.29"}, {"status": "affected", "version": "7.0.1"}, {"status": "affected", "version": "6.5.26"}, {"status": "affected", "version": "6.5.25"}, {"status": "affected", "version": "6.5.28"}, {"status": "affected", "version": "6.5.90"}, {"status": "affected", "version": "7.1.1"}, {"status": "affected", "version": "7.0.90"}, {"status": "affected", "version": "6.7.1"}, {"status": "affected", "version": "7.0.2"}, {"status": "affected", "version": "7.1.15"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "7.1.2"}, {"status": "affected", "version": "6.7.2"}, {"status": "affected", "version": "7.0.11"}, {"status": "affected", "version": "7.0.12"}, {"status": "affected", "version": "7.0.14"}, {"status": "affected", "version": "7.1.25"}, {"status": "affected", "version": "7.2.12"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.1.3"}, {"status": "affected", "version": "6.7.3"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "6.7.4"}, {"status": "affected", "version": "6.5.31"}, {"status": "affected", "version": "7.3.15"}, {"status": "affected", "version": "7.3.16"}, {"status": "affected", "version": "6.8.1"}, {"status": "affected", "version": "7.4.15"}, {"status": "affected", "version": "6.5.32"}, {"status": "affected", "version": "7.3.2"}, {"status": "affected", "version": "7.5.1"}, {"status": "affected", "version": "7.4.16"}, {"status": "affected", "version": "7.3.27"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.5.2"}, {"status": "affected", "version": "7.8.1"}, {"status": "affected", "version": "7.6.15"}, {"status": "affected", "version": "7.5.12"}, {"status": "affected", "version": "7.8.12"}, {"status": "affected", "version": "7.3.3"}, {"status": "affected", "version": "7.7.1"}, {"status": "affected", "version": "6.8.2"}, {"status": "affected", "version": "7.3.4"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "6.7.35"}, {"status": "affected", "version": "6.9.1"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.5.3"}, {"status": "affected", "version": "7.7.2"}, {"status": "affected", "version": "6.9.2"}, {"status": "affected", "version": "7.9.1"}, {"status": "affected", "version": "7.10.1"}, {"status": "affected", "version": "7.8.2"}, {"status": "affected", "version": "7.5.4"}, {"status": "affected", "version": "6.5.33"}, {"status": "affected", "version": "7.8.22"}, {"status": "affected", "version": "7.7.21"}, {"status": "affected", "version": "7.9.2"}, {"status": "affected", "version": "7.3.5"}, {"status": "affected", "version": "7.5.5"}, {"status": "affected", "version": "7.11.1"}, {"status": "affected", "version": "7.9.21"}, {"status": "affected", "version": "7.10.2"}, {"status": "affected", "version": "24.1.1"}, {"status": "affected", "version": "7.6.3"}, {"status": "affected", "version": "7.3.6"}, {"status": "affected", "version": "7.5.52"}, {"status": "affected", "version": "7.11.2"}, {"status": "affected", "version": "24.2.1"}, {"status": "affected", "version": "24.1.2"}, {"status": "affected", "version": "24.2.11"}, {"status": "affected", "version": "24.3.1"}, {"status": "affected", "version": "24.4.1"}, {"status": "affected", "version": "24.2.2"}, {"status": "affected", "version": "7.8.23"}, {"status": "affected", "version": "7.11.21"}, {"status": "affected", "version": "24.2.20"}, {"status": "affected", "version": "24.3.2"}, {"status": "affected", "version": "24.4.10"}, {"status": "affected", "version": "6.5.35"}, {"status": "affected", "version": "25.1.1"}, {"status": "affected", "version": "24.4.2"}, {"status": "affected", "version": "24.3.20"}, {"status": "affected", "version": "24.4.15"}, {"status": "affected", "version": "25.2.1"}, {"status": "affected", "version": "6.5.351"}, {"status": "affected", "version": "25.1.2"}, {"status": "affected", "version": "24.3.30"}, {"status": "affected", "version": "25.3.1"}, {"status": "affected", "version": "6.5.352"}, {"status": "affected", "version": "24.4.30"}, {"status": "affected", "version": "24.2.21"}, {"status": "affected", "version": "25.4.1"}, {"status": "affected", "version": "25.2.2"}, {"status": "affected", "version": "25.2.15"}, {"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.0.0"}, {"status": "affected", "version": "25.2.30"}, {"status": "affected", "version": "6.5.353"}, {"status": "affected", "version": "26.1.1"}, {"status": "affected", "version": "25.1.30"}, {"status": "affected", "version": "25.3.15"}, {"status": "affected", "version": "26.2.100"}, {"status": "affected", "version": "25.4.2"}, {"status": "affected", "version": "26.2.1"}, {"status": "affected", "version": "25.4.30"}, {"status": "affected", "version": "26.1.2"}, {"status": "affected", "version": "25.4.201"}, {"status": "affected", "version": "26.2.101"}, {"status": "affected", "version": "25.2.21"}]}], "source": "psirt@cisco.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20278 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) CWE-707."}], "id": "CVE-2026-20278", "lastModified": "2026-09-18T13:17:28.577", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20278", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-02T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-09-02T17:17:33.267", "references": [{"source": "psirt@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-707"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.29"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.26"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.25"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.28"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.90"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.90"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.7.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.25"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.7.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.7.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.31"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.8.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.32"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.27"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.5.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.8.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.5.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.8.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.8.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.7.35"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.9.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.5.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.7.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.9.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.9.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.10.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.8.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.5.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.33"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.8.22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.7.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.9.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.5.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.11.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.9.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.10.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.5.52"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.11.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.2.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.8.23"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.11.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.2.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.3.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.4.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.35"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.3.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.4.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.351"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.3.30"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.352"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.4.30"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.2.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.2.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.2.30"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5.353"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "26.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.1.30"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.3.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "26.2.100"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "26.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.4.30"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "26.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.4.201"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "26.2.101"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Cisco IOS XR Software", "source": "cna", "vendor": "Cisco"}, "product": "ios_xr_software", "vendor": "cisco"}], "created": "2026-09-03T09:45:03.891553+00:00", "updated": "2026-09-03T15:30:05.341585+00:00", "vendors": ["cisco", "cisco$PRODUCT$ios_xr_software"]}