CVE-2026-20276: Cisco IOS XR Software Security Hardening Release: September 2026
Published Sep 2, 2026
·Updated
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20276 are related to insufficient control flow management issues that are grouped under the Common Weakness Enumeration (CWE) CWE-691.
Affected Software
112 affected components
Cisco IOS XR Software Security Hardening Release
Cisco IOS XR=6.5.25
Cisco IOS XR=6.5.26
Cisco IOS XR=6.5.28
Cisco IOS XR=6.5.29
Cisco IOS XR=6.5.31
Cisco IOS XR=6.5.32
Cisco IOS XR=6.5.33
Cisco IOS XR=6.5.35
Cisco IOS XR=6.5.90
Cisco IOS XR=6.5.351
Cisco IOS XR=6.5.352
Cisco IOS XR=6.5.353
Cisco IOS XR=6.7.1
Cisco IOS XR=6.7.2
Cisco IOS XR=6.7.3
Cisco IOS XR=6.7.4
Cisco IOS XR=6.7.35
Cisco IOS XR=6.8.1
Cisco IOS XR=6.8.2
Cisco IOS XR=6.9.1
Cisco IOS XR=6.9.2
Cisco IOS XR=7.0.0
Cisco IOS XR=7.0.1
Cisco IOS XR=7.0.2
Cisco IOS XR=7.0.11
Cisco IOS XR=7.0.12
Cisco IOS XR=7.0.14
Cisco IOS XR=7.0.90
Cisco IOS XR=7.1.1
Cisco IOS XR=7.1.2
Cisco IOS XR=7.1.3
Cisco IOS XR=7.1.15
Cisco IOS XR=7.1.25
Cisco IOS XR=7.2.0
Cisco IOS XR=7.2.1
Cisco IOS XR=7.2.2
Cisco IOS XR=7.2.12
Cisco IOS XR=7.3.1
Cisco IOS XR=7.3.2
Cisco IOS XR=7.3.3
Cisco IOS XR=7.3.4
Cisco IOS XR=7.3.5
Cisco IOS XR=7.3.6
Cisco IOS XR=7.3.15
Cisco IOS XR=7.3.16
Cisco IOS XR=7.3.27
Cisco IOS XR=7.4.1
Cisco IOS XR=7.4.2
Cisco IOS XR=7.4.15
Cisco IOS XR=7.4.16
Cisco IOS XR=7.5.1
Cisco IOS XR=7.5.2
Cisco IOS XR=7.5.3
Cisco IOS XR=7.5.4
Cisco IOS XR=7.5.5
Cisco IOS XR=7.5.12
Cisco IOS XR=7.5.52
Cisco IOS XR=7.6.1
Cisco IOS XR=7.6.2
Cisco IOS XR=7.6.3
Cisco IOS XR=7.6.15
Cisco IOS XR=7.7.1
Cisco IOS XR=7.7.2
Cisco IOS XR=7.7.21
Cisco IOS XR=7.8.1
Cisco IOS XR=7.8.2
Cisco IOS XR=7.8.12
Cisco IOS XR=7.8.22
Cisco IOS XR=7.8.23
Cisco IOS XR=7.9.1
Cisco IOS XR=7.9.2
Cisco IOS XR=7.9.21
Cisco IOS XR=7.10.1
Cisco IOS XR=7.10.2
Cisco IOS XR=7.11.1
Cisco IOS XR=7.11.2
Cisco IOS XR=7.11.21
Cisco IOS XR=24.1.1
Cisco IOS XR=24.1.2
Cisco IOS XR=24.2.1
Cisco IOS XR=24.2.2
Cisco IOS XR=24.2.11
Cisco IOS XR=24.2.20
Cisco IOS XR=24.2.21
Cisco IOS XR=24.3.1
Cisco IOS XR=24.3.2
Cisco IOS XR=24.3.20
Cisco IOS XR=24.3.30
Cisco IOS XR=24.4.1
Cisco IOS XR=24.4.2
Cisco IOS XR=24.4.10
Cisco IOS XR=24.4.15
Cisco IOS XR=24.4.30
Cisco IOS XR=25.1.1
Cisco IOS XR=25.1.2
Cisco IOS XR=25.1.30
Cisco IOS XR=25.2.1
Cisco IOS XR=25.2.2
Cisco IOS XR=25.2.15
Cisco IOS XR=25.2.30
Cisco IOS XR=25.3.1
Cisco IOS XR=25.3.15
Cisco IOS XR=25.4.1
Cisco IOS XR=25.4.2
Cisco IOS XR=25.4.30
Cisco IOS XR=25.4.201
Cisco IOS XR=26.1.1
Cisco IOS XR=26.1.2
Cisco IOS XR=26.2.1
Cisco IOS XR=26.2.100
Cisco IOS XR=26.2.101
Event History
Sep 2, 2026
CVE Published
via MITRE·04:13 PM
Data Sourced
via MITRE·04:13 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The vector is network-based with low attack complexity. The score indicates no privileges or user interaction are required.
2
What is the expected impact if exploitation succeeds?
The reported impact is high availability impact, with no reported confidentiality or integrity impact. The CVSS vector also indicates scope change.