Search CVEs, research… / diras.sa

CVE-2026-20272: pre-auth remote code execution in Cisco Cisco IOS XE Software

Remote attackers can execute arbitrary code on Cisco IOS XE devices without authentication. CVE-2026-20272 stems from improper neutralization of special elements (CWE-74) and carries a CVSS 3.1 score of 9.8. Affected releases include multiple 16.x and 17.x builds such as 17.2.1a, 17.3.1, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d and 16.9.4c; an attacker only needs network access and does not require valid credentials or user interaction.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
9.8CRITICAL
EPSS
0.00573
CWE
CWE-74
KEV DUE DATE
Not listed
PATCH
Not yet

DIRAS TAKE

Urgent — this is a remote, no-authentication code-execution flaw, meaning internet-exposed Cisco IOS XE devices are high priority to isolate or mitigate immediately. Prioritize removing external exposure and preparing to apply vendor fixes as soon as they are released.

What is CVE-2026-20272?

Remote attackers can execute arbitrary code on Cisco IOS XE devices without authentication. CVE-2026-20272 stems from improper neutralization of special elements (CWE-74) and carries a CVSS 3.1 score of 9.8. Affected releases include multiple 16.x and 17.x builds such as 17.2.1a, 17.3.1, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d and 16.9.4c; an attacker only needs network access and does not require valid credentials or user interaction.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of Cisco Cisco IOS XE Software are affected?

BRANCHAFFECTEDFIXED
17.x17.2.1a
16.x16.12.1y
16.x16.12.3s
16.x16.7.1b
16.x16.6.2
16.x16.6.5
16.x16.12.1w
16.x16.9.1d
17.x17.3.1
16.x16.9.4c

Is CVE-2026-20272 being exploited?

There are no public reports of exploitation as of 2026-09-29.

How to fix CVE-2026-20272

  1. Isolate affected IOS XE devices from untrusted networks and block unnecessary ingress to management interfaces.
  2. Apply access controls: restrict SSH/HTTP(S)/SNMP and use ACLs or firewall rules to limit management-plane access to trusted hosts.
  3. Enable and monitor detailed logging and alert on anomalous behavior; collect full device logs for forensic review.
  4. Follow Cisco's official guidance and install vendor-supplied fixes or hardening releases as soon as Cisco publishes patched images.

Frequently asked questions

Is CVE-2026-20272 being actively exploited?

There are no public reports of exploitation of CVE-2026-20272 as of 2026-09-29.

Which Cisco IOS XE versions are affected by CVE-2026-20272?

Cisco IOS XE builds listed as affected include 17.2.1a, 17.3.1 and multiple 16.x releases such as 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d and 16.9.4c.

Is there a patch for CVE-2026-20272?

No patched releases were listed in the supplied data; administrators should follow Cisco's advisories and apply fixes or hardening updates when they become available.

Does CVE-2026-20272 require authentication?

No — the vulnerability can be exploited without authentication given network access to the affected Cisco IOS XE service.

References