CVE-2026-20275

CVE-2026-20275 tracks multiple internally discovered incorrect-calculation issues (CWE-682) in Cisco IOS XR Software, found during Cisco's internal security review and addressed through dedicated software hardening releases. According to the CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N), an unauthenticated attacker positioned on an adjacent network segment could trigger the flaw with no user interaction or privileges required. Successful exploitation carries high-impact consequences for confidentiality, integrity, and availability (CVSS 8.8, High), though the advisory summary does not detail the precise mechanism or the exact attacker gain. Any deployment running Cisco IOS XR Software is potentially affected; defenders should consult Cisco's September 2, 2026 advisory publication for exact affected releases and fixed versions, which are not specified in the available data. No public proof-of-concept, KEV listing, or known in-the-wild exploitation exists, and EPSS assigns only a 0.2% probability of exploitation within 30 days.

What to do: Watch for Cisco's September 2, 2026 advisory publication for CVE-2026-20275 and, once released, apply the IOS XR software hardening releases it identifies, since exact affected and fixed versions are not yet specified in the available data. In the meantime, inventory IOS XR devices and restrict unauthenticated access to the network segments adjacent to their management and forwarding planes. Given the low EPSS score and absence of public PoCs, this can be scheduled within normal patch cycles unless Cisco raises severity or discloses active exploitation.