CVE-2026-20278highCWE-707

CVE-2026-20278: high-severity vulnerability in Cisco IOS XR Software

Cisco IOS XR Software Security Hardening Release: September 2026

Published · Updated

Follow this CVE+ Monitor Cisco IOS XR

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. It has an official Brazilian government alert.

ssvc Trackcvss 8.8epss 0.5%
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20278 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) CWE-707.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco IOS XR Software
Related CVEs — Cisco IOS XR Software

In the same product, most dangerous first.

CVE-2020-3118HIGHCisco IOS XR Software Cisco Discovery Protocol Format String VulnerabilityEPSS 11.7%KEVCVE-2022-20821MEDIUMCisco IOS XR Software Health Check Open Port VulnerabilityEPSS 11.5%KEVCVE-2020-3566HIGHCisco IOS XR Software DVMRP Memory Exhaustion VulnerabilityEPSS 3.7%KEVCVE-2020-3569HIGHCisco IOS XR Software DVMRP Memory Exhaustion VulnerabilitiesEPSS 3.3%KEVCVE-2025-20363CRITICALCVE-2025-20363EPSS 7.2%CVE-2020-3284HIGHCisco IOS XR Software Enhanced Preboot eXecution Environment Unsigned Code Execution VulnerabilityEPSS 2.9%