AI analysis
CVE-2026-20275 tracks multiple internally discovered incorrect-calculation issues (CWE-682) in Cisco IOS XR Software, found during Cisco's internal security review and addressed through dedicated software hardening releases. According to the CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N), an unauthenticated attacker positioned on an adjacent network segment could trigger the flaw with no user interaction or privileges required. Successful exploitation carries high-impact consequences for confidentiality, integrity, and availability (CVSS 8.8, High), though the advisory summary does not detail the precise mechanism or the exact attacker gain. Any deployment running Cisco IOS XR Software is potentially affected; defenders should consult Cisco's September 2, 2026 advisory publication for exact affected releases and fixed versions, which are not specified in the available data. No public proof-of-concept, KEV listing, or known in-the-wild exploitation exists, and EPSS assigns only a 0.2% probability of exploitation within 30 days.
What to do: Watch for Cisco's September 2, 2026 advisory publication for CVE-2026-20275 and, once released, apply the IOS XR software hardening releases it identifies, since exact affected and fixed versions are not yet specified in the available data. In the meantime, inventory IOS XR devices and restrict unauthenticated access to the network segments adjacent to their management and forwarding planes. Given the low EPSS score and absence of public PoCs, this can be scheduled within normal patch cycles unless Cisco raises severity or discloses active exploitation.
Estimated exposure
large≈100,000+ systems (IOS XR powers Cisco's carrier-grade service-provider router installed base, though only devices reachable by unauthenticated… — IOS XR is the operating system across Cisco's service-provider router portfolio (e.g., ASR 9000, NCS, and 8000 series families), whose cumulative carrier and large-enterprise installed base is on the order of 100k+ systems, and the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20275 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-682.