Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-76505

Unauthenticated DoS in Cisco IOS XR IPv4 for-us handling

CVSS 3.1
7.5 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-76505 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Cisco IOS XR mishandles crafted IPv4 packets treated as for-us traffic on an affected line card. An unauthenticated remote attacker can trigger network-processor errors, resetting or shutting down the line card and causing a denial of service; repeated resets can leave the processor shut down until the line card is reloaded. Transit IPv4 and all IPv6 traffic do not trigger it. ASR 9000 and 9900 Series Aggregation Services Routers and ASR 9902 and 9903 compact routers are affected. Cisco has not listed affected builds.

What to do: Apply Cisco's update for CVE-2026-76505. No workaround is stated; a persistent shutdown may need an explicit line card reload.

ProductAffected
Cisco IOS XR Software on ASR 9000 and 9900 Series Aggregation Services Routers and ASR 9902 and 9903 Compact High-Performance—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause network processor (NP) errors, resulting in a line card reset or shutdown and a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of crafted IPv4 packets that are received on an affected line card interface and processed as for-us traffic. The issue can result in an NP reset, causing traffic loss on the affected line card while it recovers. Under repeated reset conditions, the network processor may enter a persistent shutdown state, in which case an explicit line card reload may be required to restore traffic. The vulnerability is within the IPv4 packet-processing path. Transit IPv4 traffic does not trigger this issue and IPv6 traffic cannot trigger it.

Weakness
CWE-20
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story