Cisco Fixes Seven IOS XR Vulnerabilities, Two Critical

Cisco has released fixes for seven vulnerabilities in its IOS XR network operating system, including two critical issues that could expose important routing infrastructure to remote attacks. All IOS XR releases, including IOS XR7, are affected regardless of configuration. Cisco says there are no known workarounds, although the vulnerabilities are not currently known to be actively exploited.

What the Vulnerabilities Could Allow

The most serious risks include remote code execution and root access on a router, potentially enabling traffic interception. Other reported weaknesses involve access control failures, buffer overflows, out-of-bounds access, insufficient control-flow management, and protection mechanism failures.

Two vulnerabilities, CVE-2026-20274 and CVE-2026-20279, carry critical CVSS scores of 9.8. The other five are rated between 8.2 and 8.8, placing all seven issues in the high or critical severity ranges.

Successful exploitation could lead to:

• Unauthorized access to protected resources
• Router crashes or denial of service
• Unapproved configuration changes
• Routing manipulation and network disruption
• A path toward broader compromise

Cisco's Remediation Guidance

Administrators can use the show version command to confirm whether a device runs IOS XR. Cisco advises customers to move to a release with available software maintenance upgrades, known as SMUs, and then apply the appropriate targeted fixes.

Available SMUs cover several software trains beginning with version 7.3, with as many as 16 SMUs for an individual release. Organizations using releases not listed by Cisco should contact their security support organization or open a Cisco service request. IOS XR releases 26.2.2 and 26.3.1 are identified as the first future fixed releases that will not require SMUs.

Because IOS XR can run on critical routing infrastructure, remediation should be prioritized according to each router's exposure and operational importance. Teams should also preserve configuration state and change records before and after applying updates.

Why Asset-Level Visibility Matters

A vulnerability bulletin identifies affected software, but network teams still need to determine exactly where that software is running. An effective response requires a current router inventory, software-version visibility, topology context, ownership information, and a clear record of remediation status.

That context helps teams distinguish an internet-facing or operationally critical router from a lower-risk device. It also reduces the chance that an overlooked router remains vulnerable after the main patching campaign is complete.

How ConnectMyAssets Helps

ConnectMyAssets provides an on-prem, vendor-agnostic workflow for identifying affected network assets and documenting remediation without sending infrastructure data to the cloud.

• Dynamic CMDB discovers managed Cisco routers and maintains an asset inventory for mapping affected IOS XR systems.
• CVE Tracking associates vulnerabilities with individual assets so teams can prioritize remediation by device.
• Network Topology adds LLDP-based dependency context for assessing the operational importance of affected routers.
• Backup & History captures versioned configurations with SHA256 verification, providing pre-change records and one-click configuration rollback if needed.
• Automation & ZTP supports standardized actions across selected managed devices, helping teams coordinate remediation at scale.
• Compliance Engine records security posture and weighted compliance evidence for frameworks including NIS2, ISO 27001, PCI-DSS, CISA, and NIST.
• End-of-Life / End-of-Support tracking highlights lifecycle constraints that can complicate software maintenance and long-term remediation planning.

Together, these modules turn a broad vendor advisory into an asset-specific process covering identification, prioritization, controlled change, validation, and audit evidence.

Source: Network World