Every IOS XR Release Has These Seven Holes and Cisco Has No General Workaround
Cisco has disclosed seven vulnerabilities that affect every release of IOS XR, including the IOS XR 7 LNT train. Two carry a CVSS score of 9.8, and there is no general workaround that lets operators safely postpone remediation.
The bulletin, first published on 2 September at 16:00 GMT and updated at 21:53 GMT, is unusual for its breadth. It is not one exposed service or one optional feature. The flaws touch lifecycle handling, integer operations, control flow, randomness, command evaluation, access control and exceptional conditions inside the network operating system.
Two flaws sit at the top of the list
CVE-2026-20274 is a critical lifecycle and memory-handling vulnerability. CVE-2026-20279 is a critical access-control and authentication failure. Both score 9.8, the range normally reserved for attack paths with limited prerequisites and severe consequences.
Cisco reported no known malicious exploitation at publication. That is useful context, but it does not reduce the operational problem: all releases are affected, network infrastructure has long maintenance cycles and exposed management or control-plane services can become high-value targets quickly.
The complete seven-CVE bulletin
| CVE | Weakness | CVSS |
|---|---|---|
| CVE-2026-20274 | Object lifecycle and memory handling | 9.8 |
| CVE-2026-20275 | Integer handling | 8.8 |
| CVE-2026-20276 | Control-flow handling | 8.6 |
| CVE-2026-20277 | Insufficient randomness or protection | 8.2 |
| CVE-2026-20278 | Command and expression evaluation | 8.8 |
| CVE-2026-20279 | Access control and authentication | 9.8 |
| CVE-2026-20280 | Exceptional-condition handling | 8.8 |
Cisco’s advisory provides release-specific detail and software maintenance upgrades where available. The first fully fixed releases that do not require an SMU are 26.2.2 and 26.3.1. Organisations on earlier trains need to consult Cisco’s fixed-software table rather than assume that a newer maintenance build covers the entire set.
Why seven attack paths matter together
Routers are security boundaries. They move traffic, terminate protocols and often sit in places where monitoring is thinner than it is on conventional servers. A single flaw may require a particular configuration, but a seven-flaw bulletin gives attackers more opportunities to match a weakness to a deployed environment.
It also complicates validation. A team that confirms one SMU or one fixed component may still leave another path open. Change records should list all seven identifiers and document exactly which release or SMU closes each one.
What network teams should do now
Inventory IOS XR and IOS XR 7 LNT devices, map their current trains, then use the Cisco Software Checker and the advisory’s fixed-release table. Restrict management and control-plane exposure while upgrades are planned, and collect baseline telemetry before maintenance so unexpected behaviour can be investigated later.
With no general workaround, the decision is not whether to fix the issue. It is how to move critical routing infrastructure onto a verified fixed release without creating a different outage in the process.
