CVE-2026-20267
CRITICAL 9 ALL-YEARSAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20267 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.
Severe if exploited (CVSS 9), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.4%chance of exploitation in 30 days · 32nd percentile
Impact if exploited
9CVSS 3.1 · CRITICAL · CNA
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
- CWE-284: Improper Access Control
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References and research data (JSON)
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Cisco | Ios Xe | 16.6.2 |
| Cisco | Ios Xe | 16.6.3 |
| Cisco | Ios Xe | 16.6.4 |
| Cisco | Ios Xe | 16.6.4a |
| Cisco | Ios Xe | 16.6.4s |
| Cisco | Ios Xe | 16.6.5 |
| Cisco | Ios Xe | 16.6.5a |
| Cisco | Ios Xe | 16.6.5b |
| Cisco | Ios Xe | 16.6.6 |
| Cisco | Ios Xe | 16.6.7 |
| Cisco | Ios Xe | 16.6.7a |
| Cisco | Ios Xe | 16.6.8 |
| Cisco | Ios Xe | 16.6.9 |
| Cisco | Ios Xe | 16.6.10 |
| Cisco | Ios Xe | 16.7.1 |
| Cisco | Ios Xe | 16.7.1a |
| Cisco | Ios Xe | 16.7.1b |
| Cisco | Ios Xe | 16.7.2 |
| Cisco | Ios Xe | 16.7.3 |
| Cisco | Ios Xe | 16.7.4 |
| Cisco | Ios Xe | 16.8.1 |
| Cisco | Ios Xe | 16.8.1a |
| Cisco | Ios Xe | 16.8.1b |
| Cisco | Ios Xe | 16.8.1c |
| Cisco | Ios Xe | 16.8.1d |
| Cisco | Ios Xe | 16.8.1e |
| Cisco | Ios Xe | 16.8.1s |
| Cisco | Ios Xe | 16.8.2 |
| Cisco | Ios Xe | 16.8.3 |
| Cisco | Ios Xe | 16.9.1 |
| Cisco | Ios Xe | 16.9.1a |
| Cisco | Ios Xe | 16.9.1b |
| Cisco | Ios Xe | 16.9.1c |
| Cisco | Ios Xe | 16.9.1d |
| Cisco | Ios Xe | 16.9.1s |
| Cisco | Ios Xe | 16.9.2 |
| Cisco | Ios Xe | 16.9.2a |
| Cisco | Ios Xe | 16.9.2s |
| Cisco | Ios Xe | 16.9.3 |
| Cisco | Ios Xe | 16.9.3a |
| Cisco | Ios Xe | 16.9.3h |
| Cisco | Ios Xe | 16.9.3s |
| Cisco | Ios Xe | 16.9.4 |
| Cisco | Ios Xe | 16.9.4c |
| Cisco | Ios Xe | 16.9.5 |
| Cisco | Ios Xe | 16.9.5f |
| Cisco | Ios Xe | 16.9.6 |
| Cisco | Ios Xe | 16.9.7 |
| Cisco | Ios Xe | 16.9.8 |
| Cisco | Ios Xe | 16.9.8a |
| Cisco | Ios Xe | 16.9.8b |
| Cisco | Ios Xe | 16.10.1 |
| Cisco | Ios Xe | 16.10.1a |
| Cisco | Ios Xe | 16.10.1b |
| Cisco | Ios Xe | 16.10.1c |
| Cisco | Ios Xe | 16.10.1d |
| Cisco | Ios Xe | 16.10.1e |
| Cisco | Ios Xe | 16.10.1f |
| Cisco | Ios Xe | 16.10.1g |
| Cisco | Ios Xe | 16.10.1s |
| Cisco | Ios Xe | 16.10.2 |
| Cisco | Ios Xe | 16.10.3 |
| Cisco | Ios Xe | 16.11.1 |
| Cisco | Ios Xe | 16.11.1a |
| Cisco | Ios Xe | 16.11.1b |
| Cisco | Ios Xe | 16.11.1c |
| Cisco | Ios Xe | 16.11.1s |
| Cisco | Ios Xe | 16.11.2 |
| Cisco | Ios Xe | 16.12.1 |
| Cisco | Ios Xe | 16.12.1a |
| Cisco | Ios Xe | 16.12.1c |
| Cisco | Ios Xe | 16.12.1s |
| Cisco | Ios Xe | 16.12.1t |
| Cisco | Ios Xe | 16.12.1w |
| Cisco | Ios Xe | 16.12.1x |
| Cisco | Ios Xe | 16.12.1y |
| Cisco | Ios Xe | 16.12.1z |
| Cisco | Ios Xe | 16.12.1z1 |
| Cisco | Ios Xe | 16.12.1z2 |
| Cisco | Ios Xe | 16.12.2 |
| Cisco | Ios Xe | 16.12.2a |
| Cisco | Ios Xe | 16.12.2s |
| Cisco | Ios Xe | 16.12.2t |
| Cisco | Ios Xe | 16.12.3 |
| Cisco | Ios Xe | 16.12.3a |
| Cisco | Ios Xe | 16.12.3s |
| Cisco | Ios Xe | 16.12.4 |
| Cisco | Ios Xe | 16.12.4a |
| Cisco | Ios Xe | 16.12.5 |
| Cisco | Ios Xe | 16.12.5a |
| Cisco | Ios Xe | 16.12.5b |
| Cisco | Ios Xe | 16.12.6 |
| Cisco | Ios Xe | 16.12.6a |
| Cisco | Ios Xe | 16.12.7 |
| Cisco | Ios Xe | 16.12.8 |
| Cisco | Ios Xe | 16.12.9 |
| Cisco | Ios Xe | 16.12.10 |
| Cisco | Ios Xe | 16.12.10a |
| Cisco | Ios Xe | 16.12.11 |
| Cisco | Ios Xe | 16.12.12 |
| Cisco | Ios Xe | 16.12.13 |
| Cisco | Ios Xe | 16.12.14 |
| Cisco | Ios Xe | 16.12.15 |
| Cisco | Ios Xe | 16.12.16 |
| Cisco | Ios Xe | 17.1.1 |
| Cisco | Ios Xe | 17.1.1a |
| Cisco | Ios Xe | 17.1.1s |
| Cisco | Ios Xe | 17.1.1t |
| Cisco | Ios Xe | 17.1.2 |
| Cisco | Ios Xe | 17.1.3 |
| Cisco | Ios Xe | 17.2.1 |
| Cisco | Ios Xe | 17.2.1a |
| Cisco | Ios Xe | 17.2.1r |
| Cisco | Ios Xe | 17.2.1v |
| Cisco | Ios Xe | 17.2.2 |
| Cisco | Ios Xe | 17.2.3 |
| Cisco | Ios Xe | 17.3.1 |
| Cisco | Ios Xe | 17.3.1a |
| Cisco | Ios Xe | 17.3.1w |
| Cisco | Ios Xe | 17.3.1x |
Showing 120 of 250+ configuration entries. Full list on NVD.
All CVSS metrics
- CRITICAL 9 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - CRITICAL 9 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References
Advisories
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ CVE record · cisco · Updated 2026-10-02T23:22:41.426Z
NVD · CVE-2026-20267 · Updated 2026-10-23T21:10:00.157 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53453 EUVD · EUVD-2026-53453
Technical & other
- https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-IdentificationCVE record · CVE · Updated 2026-08-14T21:00:52.391Z
NVD · CVE-2026-20267 · Updated 2026-10-23T21:10:00.157
Sources: NVD · CVE.org · All sources and attribution · EPSS