Cisco IOS XR Software Security Hardening Release: September 2026

🚨SEVERITY: CRITICAL — CVSS 9.8Security Advisory

TL;DR 📌

  • As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To…
  • Highest CVSS: 9.8 (Critical).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-20274, CVE-2026-20275, CVE-2026-20276.

What it is

Cisco has published one advisory covering seven CVEs, all found during an internal security review of IOS XR Software rather than through external report or exploitation. Under Cisco’s newer disclosure model, each CVE ID represents a CWE (weakness class) rather than a single flaw, so each one groups several related internally-discovered bugs found across different subsystems.

Two of the seven are rated 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — unauthenticated, remotely reachable, no user interaction, full loss of confidentiality, integrity and availability. CVE-2026-20274 groups CWE-664 issues (improper control of a resource through its lifetime): buffer overflows, use-after-free, out-of-bounds read/write, and similar memory-safety defects. CVE-2026-20279 groups CWE-284 issues (improper access control): missing authentication for a critical function, missing or incorrect authorisation, and improper certificate validation.

The remaining five sit in the 8.2–8.8 range. CVE-2026-20275 (CWE-682, incorrect calculation — buffer-size miscalculation, integer overflow/underflow) needs adjacent-network access rather than remote. CVE-2026-20278 (CWE-707, improper neutralisation — command/code injection, index and length validation failures) and CVE-2026-20280 (CWE-703, improper handling of exceptional conditions — length-parameter mishandling, unsafe failure modes) both require low privileges. CVE-2026-20276 (CWE-691, insufficient control flow — reachable assertions, loops without exit conditions) affects availability only but can change the scope of impact. CVE-2026-20277 (CWE-693, protection mechanism failure — use of insufficiently random values) has a limited confidentiality impact.

Cisco states that all seven affect every release of IOS XR Software, including IOS XR7 (LNT), regardless of how the device is configured. Individual underlying fixes are tied to specific features and protocols — the advisory lists MPLS, MPLS-TE, multicast, OSPF, segment routing (IPv4 and IPv6), the TCP Authentication Option, and Zero Touch Provisioning among the areas patched, each with its own software maintenance upgrade (SMU) depending on release train. There are no workarounds. Cisco says it is not aware of any public disclosure or malicious use, and the set is not listed in CISA’s Known Exploited Vulnerabilities catalogue.

What to do

  • Where possible, move straight to IOS XR 26.2.2 or 26.3.1 — these are the first releases that contain the actual fixes rather than SMU-based mitigations.
  • If you’re on an earlier train, there is no fixed base image yet for most of them; you’ll need to apply SMUs instead. Cisco lists roughly 16 SMUs per train to cover the different CWE groupings, for example: 7.9.2/7.9.21, 7.10.2, 7.11.2/7.11.21, 24.2.2/24.2.21, 24.3.2, 24.4.2, 25.2.2/25.2.21, 25.4.2 (non-optical) or 25.4.12 (optical), and 26.1.2. Check the fixed-releases table for your specific train and platform.
  • If you run 24.1 or 25.1, note that fixes are still pending as future releases (24.1.2 and 25.1.2 respectively) — track the advisory for their publication.
  • Since there are no workarounds, patching (via full upgrade or SMU) is the only mitigation — there is nothing to disable or restrict in the meantime.
  • Because fixes are tied to specific features (MPLS, MPLS-TE, multicast, OSPF, segment routing, TCP Authentication Option, ZTP), cross-check which of these you actually run against the per-feature SMU identifiers in the advisory rather than assuming one SMU covers everything for your release.
  • Confirm whether your devices run IOS XR7 (LNT) using show version — the output will show “LNT” against the version string — as this affects which platforms and SMU sets apply (Cisco 8000 Series, NCS 1010, NCS 540L, NCS 5700 Series).

For leadership 🧭

Executive summary. Every release of IOS XR Software, including IOS XR7 (LNT) on Cisco 8000, NCS 1010, NCS 540L and NCS 5700 platforms, is affected by seven internally discovered flaws, two of which allow an unauthenticated remote attacker to fully compromise a device with no user interaction. There are no workarounds, so patching is the only option, and given the two 9.8-rated issues this warrants scheduling upgrades or SMUs at the next available change window rather than deferring.

Why it matters:

  • CVE-2026-20274 and CVE-2026-20279 are rated 9.8 and reachable over the network with no authentication or user interaction, covering memory-safety bugs and missing/incorrect authentication or authorisation across IOS XR subsystems.
  • Fixes are scattered across roughly 16 SMUs per release train and tied to specific features (MPLS, MPLS-TE, multicast, OSPF, segment routing, TCP Authentication Option, ZTP), so a single upgrade may not close every gap unless the right per-feature SMUs are applied.
  • Customers on the 24.1 or 25.1 trains have no fixed release available yet – 24.1.2 and 25.1.2 are still pending – leaving those devices without a full remediation path for now.
  • With no workarounds documented, any device left unpatched on an affected train remains exposed on every feature path listed, regardless of configuration.

Now / Next / Later:

  • Now: Run show version across your IOS XR estate to identify affected trains and confirm which devices run IOS XR7 (LNT), then map each against the fixed-releases table to see whether a full fix or only SMUs are available.
  • Next: In the next change window, upgrade devices that can move straight to IOS XR 26.2.2 or 26.3.1; for earlier trains, apply the specific SMUs covering the features you actually run (MPLS, MPLS-TE, multicast, OSPF, segment routing, TCP Authentication Option, ZTP) rather than assuming one SMU covers everything.
  • Later: Track Cisco’s advisory for the pending 24.1.2 and 25.1.2 releases if you run those trains, and build a recurring process to cross-check per-feature SMU coverage against your configuration whenever Cisco issues grouped hardening advisories like this one.

Source