Cisco IOS Xr

SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2; (6) SNMP Research before 16.2; (7) multiple Cisco IOS, CatOS, ACE, and Nexus products; (8) Ingate Firewall 3.1.0 and later and SIParator 3.1.0 and later; (9) HP OpenView SNMP Emanate Master Agent 15.x; and possibly other products relies on the client to specify the HMAC length, which makes it easier for remote attackers to bypass SNMP authentication via a length value of 1, which only checks the first byte.

Cisco IOS XR Software Enhanced Preboot eXecution Environment Unsigned Code Execution Vulnerability

Cisco IOS XR 64-Bit Software for Cisco ASR 9000 Series Aggregation Services Routers Network Isolation Vulnerability

Cisco IOS XR Software Security Hardening Release: September 2026

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory.

Cisco Small Business RV Series Routers Command Injection Vulnerability

Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability

Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCuo17183, CSCvd73487.

Cisco Network Services Orchestrator Configuration Update Authorization Bypass Vulnerability

Cisco IOS XR Software Security Hardening Release: September 2026

Cisco IOS XR Software CLI Privilege Escalation Vulnerability

Cisco IOS XR Software Local Privilege Escalation Vulnerability

Cisco IOS XR Software CLI Privilege Escalation Vulnerability

Cisco IOS XR Software CLI Privilege Escalation Vulnerability

A vulnerability in the Local Packet Transport Services (LPTS) feature set of Cisco ASR 9000 Series Aggregation Services Router Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input and validation checking on certain Precision Time Protocol (PTP) ingress traffic to an affected device. An attacker could exploit this vulnerability by injecting malformed traffic into an affected device. A successful exploit could allow the attacker to cause services on the device to become unresponsive, resulting in a DoS condition. Cisco Bug IDs: CSCvj22858.

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities

A vulnerability in the IPv6 subsystem of Cisco IOS XR Software Release 5.3.4 for the Cisco Aggregation Services Router (ASR) 9000 Series could allow an unauthenticated, remote attacker to trigger a reload of one or more Trident-based line cards, resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect handling of IPv6 packets with a fragment header extension. An attacker could exploit this vulnerability by sending IPv6 packets designed to trigger the issue either to or through the Trident-based line card. A successful exploit could allow the attacker to trigger a reload of Trident-based line cards, resulting in a DoS during the period of time the line card takes to restart. This vulnerability affects Cisco Aggregation Services Router (ASR) 9000 Series when the following conditions are met: The router is running Cisco IOS XR Software Release 5.3.4, and the router has installed Trident-based line cards that have IPv6 configured. A software maintenance upgrade (SMU) has been made available that addresses this vulnerability. The fix has also been incorporated into service pack 7 for Cisco IOS XR Software Release 5.3.4. Cisco Bug IDs: CSCvg46800.

Cisco IOS XR Software Enf Broker Denial of Service Vulnerability

Cisco IOS XR Software Enf Broker Denial of Service Vulnerability

Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers Slow Path Forwarding Denial of Service Vulnerability

Cisco ASR 9000 Series Aggregation Services Routers ACL Bypass Vulnerability

Cisco IOS XR Software for ASR 9000 Series Routers Lightspeed-Plus Line Cards Denial of Service Vulnerability

Cisco IOS XR Software BGP EVPN Denial of Service Vulnerabilities

Cisco IOS XR Software BGP EVPN Denial of Service Vulnerabilities

Cisco IOS XR Software Border Gateway Protocol Attribute Denial of Service Vulnerability

Cisco IOS XR Software BGP EVPN Denial of Service Vulnerabilities

Cisco IOS XR Software BGP EVPN Denial of Service Vulnerabilities

Cisco IOS XR Software BGP EVPN Denial of Service Vulnerabilities

Cisco IOS XR Software IP Service Level Agreements and Two-Way Active Measurement Protocol Denial of Service Vulnerability

Cisco IOS XR Software for ASR 9000 Series Routers Bidirectional Forwarding Detection Denial of Service Vulnerability

Cisco IOS XR Software Border Gateway Protocol Denial of Service Vulnerability

Cisco IOS XR Software Packet Memory Exhaustion Vulnerability

Cisco IOS XR Software for ASR 9000 Series Routers L2VPN Denial of Service Vulnerability

Cisco IOS XR Software for ASR 9000 Series Routers Layer 3 Multicast Routing Denial of Service Vulnerability

Cisco IOS, IOS XE and IOS XR Software TWAMP Denial of Service Vulnerability

Cisco IOS XR Software Security Hardening Release: September 2026

Cisco IOS XR Software Arbitrary File Read and Write Vulnerability

Cisco IOS XR Authenticated User Privilege Escalation Vulnerability

Cisco Routed Passive Optical Network Cleartext Password Vulnerability