CVE-2026-20271
HIGH 8.6As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20271 are related to insufficient control flow management issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-691.
Severe if exploited (CVSS 8.6), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 19th percentile
Impact if exploited
8.6CVSS 3.1 · HIGH
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
- github-search Search GitHub for public PoC repos
Test against your own equipment
curl -s https://vulnpedia.com/cve/CVE-2026-20271/poc.jsonMachine-readable PoC index for this CVE (for automation).Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-20271/poc.json
Weakness (CWE)
- CWE-691: Insufficient Control Flow Management
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Cisco | Ios Xe | 16.6.2 |
| Cisco | Ios Xe | 16.6.3 |
| Cisco | Ios Xe | 16.6.4 |
| Cisco | Ios Xe | 16.6.4a |
| Cisco | Ios Xe | 16.6.4s |
| Cisco | Ios Xe | 16.6.5 |
| Cisco | Ios Xe | 16.6.5a |
| Cisco | Ios Xe | 16.6.5b |
| Cisco | Ios Xe | 16.6.6 |
| Cisco | Ios Xe | 16.6.7 |
| Cisco | Ios Xe | 16.6.7a |
| Cisco | Ios Xe | 16.6.8 |
| Cisco | Ios Xe | 16.6.9 |
| Cisco | Ios Xe | 16.6.10 |
| Cisco | Ios Xe | 16.7.1 |
| Cisco | Ios Xe | 16.7.1a |
| Cisco | Ios Xe | 16.7.1b |
| Cisco | Ios Xe | 16.7.2 |
| Cisco | Ios Xe | 16.7.3 |
| Cisco | Ios Xe | 16.7.4 |
| Cisco | Ios Xe | 16.8.1 |
| Cisco | Ios Xe | 16.8.1a |
| Cisco | Ios Xe | 16.8.1b |
| Cisco | Ios Xe | 16.8.1c |
| Cisco | Ios Xe | 16.8.1d |
| Cisco | Ios Xe | 16.8.1e |
| Cisco | Ios Xe | 16.8.1s |
| Cisco | Ios Xe | 16.8.2 |
| Cisco | Ios Xe | 16.8.3 |
| Cisco | Ios Xe | 16.9.1 |
| Cisco | Ios Xe | 16.9.1a |
| Cisco | Ios Xe | 16.9.1b |
| Cisco | Ios Xe | 16.9.1c |
| Cisco | Ios Xe | 16.9.1d |
| Cisco | Ios Xe | 16.9.1s |
| Cisco | Ios Xe | 16.9.2 |
| Cisco | Ios Xe | 16.9.2a |
| Cisco | Ios Xe | 16.9.2s |
| Cisco | Ios Xe | 16.9.3 |
| Cisco | Ios Xe | 16.9.3a |
| Cisco | Ios Xe | 16.9.3h |
| Cisco | Ios Xe | 16.9.3s |
| Cisco | Ios Xe | 16.9.4 |
| Cisco | Ios Xe | 16.9.4c |
| Cisco | Ios Xe | 16.9.5 |
| Cisco | Ios Xe | 16.9.5f |
| Cisco | Ios Xe | 16.9.6 |
| Cisco | Ios Xe | 16.9.7 |
| Cisco | Ios Xe | 16.9.8 |
| Cisco | Ios Xe | 16.9.8a |
| Cisco | Ios Xe | 16.9.8b |
| Cisco | Ios Xe | 16.10.1 |
| Cisco | Ios Xe | 16.10.1a |
| Cisco | Ios Xe | 16.10.1b |
| Cisco | Ios Xe | 16.10.1c |
| Cisco | Ios Xe | 16.10.1d |
| Cisco | Ios Xe | 16.10.1e |
| Cisco | Ios Xe | 16.10.1f |
| Cisco | Ios Xe | 16.10.1g |
| Cisco | Ios Xe | 16.10.1s |
| Cisco | Ios Xe | 16.10.2 |
| Cisco | Ios Xe | 16.10.3 |
| Cisco | Ios Xe | 16.11.1 |
| Cisco | Ios Xe | 16.11.1a |
| Cisco | Ios Xe | 16.11.1b |
| Cisco | Ios Xe | 16.11.1c |
| Cisco | Ios Xe | 16.11.1s |
| Cisco | Ios Xe | 16.11.2 |
| Cisco | Ios Xe | 16.12.1 |
| Cisco | Ios Xe | 16.12.1a |
| Cisco | Ios Xe | 16.12.1c |
| Cisco | Ios Xe | 16.12.1s |
| Cisco | Ios Xe | 16.12.1t |
| Cisco | Ios Xe | 16.12.1w |
| Cisco | Ios Xe | 16.12.1x |
| Cisco | Ios Xe | 16.12.1y |
| Cisco | Ios Xe | 16.12.1z |
| Cisco | Ios Xe | 16.12.1z1 |
| Cisco | Ios Xe | 16.12.1z2 |
| Cisco | Ios Xe | 16.12.2 |
| Cisco | Ios Xe | 16.12.2a |
| Cisco | Ios Xe | 16.12.2s |
| Cisco | Ios Xe | 16.12.2t |
| Cisco | Ios Xe | 16.12.3 |
| Cisco | Ios Xe | 16.12.3a |
| Cisco | Ios Xe | 16.12.3s |
| Cisco | Ios Xe | 16.12.4 |
| Cisco | Ios Xe | 16.12.4a |
| Cisco | Ios Xe | 16.12.5 |
| Cisco | Ios Xe | 16.12.5a |
| Cisco | Ios Xe | 16.12.5b |
| Cisco | Ios Xe | 16.12.6 |
| Cisco | Ios Xe | 16.12.6a |
| Cisco | Ios Xe | 16.12.7 |
| Cisco | Ios Xe | 16.12.8 |
| Cisco | Ios Xe | 16.12.9 |
| Cisco | Ios Xe | 16.12.10 |
| Cisco | Ios Xe | 16.12.10a |
| Cisco | Ios Xe | 16.12.11 |
| Cisco | Ios Xe | 16.12.12 |
| Cisco | Ios Xe | 16.12.13 |
| Cisco | Ios Xe | 16.12.14 |
| Cisco | Ios Xe | 16.12.15 |
| Cisco | Ios Xe | 16.12.16 |
| Cisco | Ios Xe | 17.1.1 |
| Cisco | Ios Xe | 17.1.1a |
| Cisco | Ios Xe | 17.1.1s |
| Cisco | Ios Xe | 17.1.1t |
| Cisco | Ios Xe | 17.1.2 |
| Cisco | Ios Xe | 17.1.3 |
| Cisco | Ios Xe | 17.2.1 |
| Cisco | Ios Xe | 17.2.1a |
| Cisco | Ios Xe | 17.2.1r |
| Cisco | Ios Xe | 17.2.1v |
| Cisco | Ios Xe | 17.2.2 |
| Cisco | Ios Xe | 17.2.3 |
| Cisco | Ios Xe | 17.3.1 |
| Cisco | Ios Xe | 17.3.1a |
| Cisco | Ios Xe | 17.3.1w |
| Cisco | Ios Xe | 17.3.1x |
Showing 120 of 250+ configuration entries. Full list on NVD.
All CVSS metrics
- HIGH 8.6 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - HIGH 8.6 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H