CVE-2026-20274 and CVE-2026-20279: Cisco IOS XR hardening release — no workarounds

Summary

Parameter	Value
CVE ID (lead entry)	CVE-2026-20274
Vulnerabilities covered	2 (CVE-2026-20274, CVE-2026-20279) — the Cisco advisory covers 7 identifiers in total
Alert Source	GitHub Advisory - Critical Vulnerability
CVE Publication Year	2026
Date Published	2026-09-02
Vendor	Cisco
Product	IOS XR Software (including IOS XR7 / LNT)
CVSS Score	9.8 and 9.8 (critical)
CVSS Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Workaround	None (Workarounds: No)
CISA KEV	No
Ransomware	Not confirmed

Vulnerability Description

The Cisco IOS XR Software engineering team conducted a comprehensive internal security review, which resulted in software hardening releases addressing multiple internally discovered vulnerabilities. Advisory cisco-sa-hardening-iosxr-qg64NcM groups them into seven classes by CWE category and assigns one CVE identifier to each class. Two of them reached our alert channel — both rated 9.8 CVSS:

CVE	CVSS	Class (CWE)	Class description
CVE-2026-20274	9.8	CWE-664	improper control of a resource through its lifetime — covers buffer copy without checking size of input, and stack-based and heap-based buffer overflows
CVE-2026-20279	9.8	CWE-284	improper access control

The full advisory covers seven identifiers: CVE-2026-20274, CVE-2026-20275, CVE-2026-20276, CVE-2026-20277, CVE-2026-20278, CVE-2026-20279 and CVE-2026-20280, corresponding to CWE-284, CWE-664, CWE-682, CWE-691, CWE-693, CWE-703 and CWE-707.

An important methodological caveat from Cisco: the CVSS score assigned to each CVE represents the maximum potential severity of the single most impactful underlying vulnerability within that specific CWE category — not a score for each individual flaw. An identifier here is a label for a class of problems, not a single bug.

Why this is not a routine update. Three circumstances coincide, any one of which would force urgent action on its own: all IOS XR releases are affected, regardless of device configuration; there is no workaround at all; and IOS XR runs on service provider and core routers — platforms such as ASR 9000, NCS and CRS that carry backbone traffic. There is no “restrict access to the service and wait for a maintenance window” option here.

Required Actions

1. Inventory your IOS XR devices. All releases are affected, so the question is not “which version” but “where do we run IOS XR at all”. To check whether a device runs IOS XR7 (LNT), use:

   RP/0/RP0/CPU0:Router#show version

   Output containing the string LNT indicates IOS XR7 (LNT).

2. Plan an upgrade to a release that has SMUs available, then apply all the relevant SMUs. The advisory notes there may be approximately 16 SMUs per release covering the vulnerabilities in this bulletin — this is not a single patch and requires a planned maintenance window.

3. Consider the SMU-free target path. According to Cisco, the first releases to contain the fixes without requiring SMUs will be the future 26.2.2 and 26.3.1. For environments where applying a dozen-plus SMUs is operationally expensive this may be the more sensible target — provided the risk during the waiting period is consciously accepted.

4. Do not count on a workaround. Cisco states plainly that none exist. The only compensating measure until you patch is reducing exposure of the management and control planes (out-of-band management separation, access control lists on management interfaces, CoPP) — which lowers risk but does not remove the vulnerability.

5. Check the current fixed-release table directly in the Cisco advisory. The Fixed Releases section is maintained by the vendor and gets updated.

Who Is Affected?

The vulnerabilities affect all releases of Cisco IOS XR Software, including Cisco IOS XR7 (LNT), regardless of device configuration. Cisco notes that only products listed in the Vulnerable Products section of the advisory are known to be affected.

IOS XR is the operating system of Cisco service provider and core routers. In practice this concerns telecom operators, internet service providers, large data centres and critical infrastructure operators — organisations for which edge and backbone devices are simultaneously the most exposed and the hardest to take offline for patching.

Entities in scope of the NIS2 directive should treat this bulletin as an event requiring a documented decision: either an urgent-track upgrade, or a formal, recorded risk acceptance together with a description of compensating controls.

Sources

• NVD - CVE-2026-20274
• NVD - CVE-2026-20279
• Cisco Security Advisory: cisco-sa-hardening-iosxr-qg64NcM
• FIRST EPSS

---

Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.