CVE-2026-20074

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-20074
A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) multi-instance routing feature of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the IS-IS process to restart unexpectedly. This vulnerability is due to insufficient input validation of ingress IS-IS packets. An attacker could exploit this vulnerability by sending crafted IS-IS packets to an affected device after forming an adjacency. A successful exploit could allow the attacker to cause the IS-IS process to restart unexpectedly, resulting in a temporary loss of connectivity to advertised networks and a denial of service (DoS) condition. Note: The IS-IS protocol is a routing protocol. To exploit this vulnerability, an attacker must be Layer 2-adjacent to the affected device and must have formed an adjacency.  

7.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 4.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isis-dos-kDMxpSzK Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xr:25.3.0:*:*:*:*:*:*:*
History

08 Jul 2026, 19:07

Type Values Removed Values Added
First Time Cisco ios Xr
Cisco
CPE cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xr:25.3.0:*:*:*:*:*:*:*
References () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isis-dos-kDMxpSzK - () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isis-dos-kDMxpSzK - Mitigation, Vendor Advisory

17 Jun 2026, 10:17

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad en la función de enrutamiento multi-instancia de Intermediate System-to-Intermediate System (IS-IS) de Cisco IOS XR Software podría permitir a un atacante no autenticado y adyacente causar que el proceso IS-IS se reinicie inesperadamente. Esta vulnerabilidad se debe a una validación de entrada insuficiente de los paquetes IS-IS de entrada. Un atacante podría explotar esta vulnerabilidad enviando paquetes IS-IS manipulados a un dispositivo afectado después de formar una adyacencia. Un exploit exitoso podría permitir al atacante causar que el proceso IS-IS se reinicie inesperadamente, lo que resultaría en una pérdida temporal de conectividad a las redes anunciadas y una condición de denegación de servicio (DoS). Nota: El protocolo IS-IS es un protocolo de enrutamiento. Para explotar esta vulnerabilidad, un atacante debe ser adyacente en Capa 2 al dispositivo afectado y debe haber formado una adyacencia.

11 Mar 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-11 17:16

Updated : 2026-07-08 19:07

NVD link : CVE-2026-20074

Mitre link : CVE-2026-20074

CVE.ORG link : CVE-2026-20074

JSON object : View

Products Affected

cisco

  • ios_xr
CWE
CWE-1287

Improper Validation of Specified Type of Input