Vulnerability intelligence
CVE-2026-20275 and is rated High severity with a CVSS score of 8.8. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.
To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class - Common Weakness Enumeration (CWE) - and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping.
On September 2, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco IOS XR Software Security Hardening Release: September 2026 CVE-2026-20277CVE-2026-20278CVE-2026-20280CVE-2026-20279CVE-2026-20276CVE-2026-20275CVE-2026-20274 Critical 9.8 Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability CVE-2026-20212 Critical 9.8 Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability CVE-2026-20281 High 7.5 Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities CVE-2026-20355CVE-2026-20354 Medium 5.9 To remediate the vulnerabiliti
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20275 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-682.
Source: NVD
Cisco Security Advisories · Updated Sep 17, 2026
These vulnerabilities affect all releases of Cisco IOS XR Software, including Cisco IOS XR7 (LNT) Software, regardless of device configuration.
For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.
Determine Whether a Device is Running Cisco IOS XR7 (LNT) Software
To determine whether a device is running Cisco IOS XR7 (LNT) Software, use the show version command. If the command returns output that contains LNT, as shown in the following example, the device is running Cisco IOS XR7 (LNT) Software:
RP/0/RP0/CPU0:Router#show version Tue Sep 1 05:44:27.305 UTC Cisco IOS XR Software, Version 24.3.2 LNT RP/0/RP0/CPU0:Router#
There are no workarounds that address these vulnerabilities.
To remediate these vulnerabilities and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.
In the following table, the left column lists the affected Cisco IOS XR Software train, and the right column lists the first release that includes the fixes for these vulnerabilities, and the releases that have SMUs for affected platforms to address these vulnerabilities.
Customers are advised upgrade to a fixed release. If a fixed release is not available, do the following based on the table:
Upgrade to a release that has available SMUs.
Apply the appropriate SMUs for the upgraded release.
There may be approximately 16 SMUs available for each release to mitigate the vulnerabilities that are covered by the CWEs in this advisory. Cisco IOS XR Software releases 26.2.2 and 26.3.1 are the first fixed releases that contain fixes for the vulnerabilities that are described in this advisory.
Cisco IOS XR Software Train | First Fixed Release and SMU Availability |
|---|---|
7.3 (optical only) | SMUs available for 7.3.21 |
7.9 | SMUs available for 7.9.2 and 7.9.21 |
7.10 | SMUs available for 7.10.2 |
7.11 | SMUs available for 7.11.2 and 7.11.21 |
24.1 | SMUs available for 24.1.2 |
24.2 | SMUs available for 24.2.2 and 24.2.21 |
24.3 | SMUs available for 24.3.2 |
24.4 | SMUs available for 24.4.2 |
25.1 | SMUs available for 25.1.2 |
25.2 | SMUs available for 25.2.2 and 25.2.21 |
25.4 (optical only) | SMUs available for 25.4.12 |
25.4 (non-optical) | SMUs available for 25.4.2 |
26.1 | SMUs available for 26.1.2 |
26.2 | SMUs available for 26.2.1 26.2.2 |
26.3 | 26.3.1 |
1. SMUs for Release 7.3.2 are available only for the optical platform Cisco Network Convergence System (NCS) 1002.
2. SMUs for Release 25.4.1 are available only for the optical platforms Cisco NCS 1001, Cisco NCS 1004, and Cisco NCS 1010.
For more information on finding which SMUs may have been published for these vulnerabilities, see the Download SMUs from Cisco.com section of Understand Cisco IOS XR Software Maintenance Updates (SMUs).
In the following table, the left column lists the affected Cisco IOS XR Software functional areas, the middle column lists affected releases and platforms, and the right column the right column indicates whether a functional area is affected by this vulnerability and lists the SMU identifier that can be used to locate the the appropriate SMU.
For example, the SMU for Release 24.2.2 for Cisco IOS XRv 9000 Routers BGP would be named xrv9k-24.2.2.CSCwu14807.tar.
Note: SMU identifiers are unique identifiers, not Cisco Bug IDs. All SMUs may not be applicable to all releases and platforms.
Affected Cisco IOS XR Software Functional Area | Cisco IOS XR Software Releases and Platforms | SMU Identifiers |
|---|---|---|
All XR7 (LNT) Platforms1 | All releases and XR7 (LNT) platforms | CSCwv19790 |
BGP | 7.10 and earlier trains 26.2.1 | Not vulnerable |
All other releases and platforms | CSCwu14807 | |
crypto-ike | All releases and platforms | CSCwv19170 |
gRPC | All releases and platforms | CSCwt41683 |
IP-SLA | All releases and platforms | CSCwv19173 |
Intermediate System-to-Intermediate System (IS-IS) | 25.4.1 and 25.4.2 | CSCwu13271 and CSCwv191712 |
26.1.2 and 26.2.1 | CSCwv191712 | |
All other releases and platforms | CSCwv45645 and CSCwv191712 | |
MPLS | All releases and platforms | CSCwu14825 |
MPLS-TE | 7.10.2 | CSCwv191813 |
All other releases and platforms | CSCwv407533 | |
Multicast | 26.1.2 and 26.2.1 | CSCwv19180 |
All other releases and platforms | CSCwv19180 and CSCwu08799 | |
OSPF | All releases and platforms | CSCwv407414 and CSCwv191712 |
Segment routing (IPv6 only) | 7.11.21 24.2.21 25.2.21 25.4.1 | CSCwv56312 |
7.9.21 on 64-bit ASR 9000 Series Aggregation Services Routers | CSCwv56312 | |
7.3.2 on NCS1002 | CSCwv56312 | |
26.1.2 and 26.2.1 | Not vulnerable | |
All other releases and platforms | CSCwu132685 | |
Segment routing (IPv4 only) or Segment routing (IPv4 and IPv6) | All releases and platforms | CSCwv38342 |
TCP Authentication Option | All releases and platforms | CSCwv361436 |
Zero Touch Provisioning (ZTP) | 26.2.1 | Not vulnerable |
All other releases and platforms | CSCwu36622 |
1. Platforms that run Cisco IOS XR7 (LNT) Software include Cisco 8000 Series Routers, Cisco NCS 1010, Cisco NCS 540L Routers, and Cisco NCS 5700 Series regardless of optional features installed. To determine whether a device is running Cisco IOS XR7 (LNT) Software using the CLI, see the Vulnerable Products section of this advisory.
2. CSCwv19171 applies to both IS-IS and OSPF.
3. For release train 7.10.2 only, SMU Identifier CSCwv19181 supersedes CSCwv40753. For all other release trains, SMU Identifier CSCwv40753 supersedes CSCwv19181.
4. SMU Identifier CSCwv40741 supersedes CSCwv19174.
5. SMU Identifier CSCwu13268 supersedes CSCwv19178.
6. SMU Identifier CSCwv36143 supersedes CSCwu14817.
The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.