Detections
Analytics

Cisco IOS XR Software Security Hardening Release: September 2026 (cisco-sa-hardening-iosxr-qg64NcM)

high Nessus Plugin ID 348487

Language:

Synopsis

The remote device is missing a vendor-supplied security patch

Description

According to its self-reported version, Cisco IOS XR is affected by multiple vulnerabilities.

 - Multiple vulnerabilities in Cisco IOS XR Software due to improper resource control issues could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service condition on an affected device. (CVE-2026-20274)

 - Multiple vulnerabilities in Cisco IOS XR Software due to improper access control issues could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. (CVE-2026-20279)

 - Multiple vulnerabilities in Cisco IOS XR Software due to incorrect calculation issues could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service condition on an affected device. (CVE-2026-20275)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Solution

Upgrade to Cisco IOS XR Software Release 26.2.2 or 26.3.1, or apply all applicable SMUs referenced in Cisco bug IDs CSCwt41683, CSCwu08799, CSCwu13268, CSCwu13271, CSCwu14807, CSCwu14825, CSCwu36622, CSCwv19170, CSCwv19171, CSCwv19173, CSCwv19180, CSCwv19181, CSCwv19790, CSCwv36143, CSCwv38342, CSCwv40741, CSCwv40753, CSCwv45645, CSCwv56312.

See Also

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwt41683

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu08799

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu13268

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu13271

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu14807

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu14825

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu36622

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv19170

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv19171

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv19173

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv19180

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv19181

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv19790

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv36143

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv38342

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv40741

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv40753

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv45645

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv56312

http://www.nessus.org/u?fde58b02

Plugin Details

Severity: High

ID: 348487

File Name: cisco-sa-hardening-iosxr-qg64NcM-iosxr.nasl

Version: 1.2

Type: Combined

Family: CISCO

Published: 9/21/2026

Updated: 9/22/2026

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 98.97

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-20276

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:cisco:ios_xr

Required KB Items: Host/Cisco/IOS-XR/Version, Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 9/2/2026

Vulnerability Publication Date: 9/2/2026

Reference Information

CVE: CVE-2026-20274, CVE-2026-20275, CVE-2026-20276, CVE-2026-20277, CVE-2026-20278, CVE-2026-20279, CVE-2026-20280