Cisco Updates IOS XR Software

To determine whether a device is running Cisco IOS XR7 (LNT) Software, use the show version command. If the command returns output that contains LNT, as shown in the following example, the device is running Cisco IOS XR7 (LNT) Software:

RP/0/RP0/CPU0:Router#show version
Tue Sep 1 05:44:27.305 UTC
Cisco IOS XR Software, Version 24.3.2 LNT
RP/0/RP0/CPU0:Router#

Cisco released software updates that address these vulnerabilities, according to an advisory. There are no workarounds that address these vulnerabilities.

Vulnerabilities

In one issue, there is an improper control of a resource through its lifetime (covers buffer copy without checking size of input, stack-based buffer overflow, heap-based buffer overflow, out-of-bounds read, use of externally-controlled format string, numeric truncation error, use after free, exposure of resource to wrong sphere, operation on a resource after expiration or release, allocation of resources without limits or throttling, out-of-bounds write, use of out-of-range pointer offset, and initialization of a resource with an insecure default).

CVE-2026-20274 is the case number for the vulnerability which has a CVSS base score of 9.8.

Additionally, there is an incorrect calculation (covers incorrect calculation of buffer size, integer overflow or wraparound, and integer underflow (wrap or wraparound)).

CVE-2026-20275 is the case number for the vulnerability which has a CVSS base score of 8.8.

Also, there is insufficient control flow management (covers reachable assertion and loop with unreachable exit condition).

CVE-2026-20276 is the case number for the vulnerability which has a CVSS base score of 8.6.

Meanwhile, there is a protection mechanism failure (covers use of insufficiently random values).

CVE-2026-20277 is the case number for the vulnerability which has a CVSS base score of 8.2.

Moreover, there is improper neutralization (covers improper neutralization of special elements used in a command, improper neutralization of directives in dynamically evaluated code, improper validation of array index, improper validation of specified quantity in input, and improper validation of specified index, position, or offset in input).

CVE-2026-20278 is the case number for the vulnerability which has a CVSS base score of 8.8.

Improper Access Control

Furthermore, there is improper access control (covers improper certificate validation, missing authentication for critical function, missing authorization, and incorrect authorization).

CVE-2026-20279 is the case number for the vulnerability which has a CVSS base score of 9.8.

Indeed, there is improper check or handling of exceptional conditions (covers improper handling of length parameter inconsistency and not failing securely).

CVE-2026-20280 is the case number for the vulnerability which has a CVSS base score of 8.8.

There are no workarounds that address these vulnerabilities.

To remediate these vulnerabilities and avoid future exposure, Cisco strongly recommends customers upgrade to the fixed software indicated in this advisory.

In the table below, the left column lists the affected Cisco IOS XR Software train, and the right column lists which releases have SMUs for affected platforms to address these vulnerabilities or which future releases will contain the fixes.

Users should complete the following actions based on the table:

• Upgrade to a release that has available SMUs.
• Apply the appropriate SMUs for the upgraded release.

There may be approximately 16 SMUs available for each release to mitigate the vulnerabilities that are covered by the CWEs in this advisory. Future Cisco IOS XR Software releases 26.2.2 and 26.3.1 will be the first fixed releases that will not require SMUs.

Click here for other Cisco security updates.