CVE-2026-20272

EUVD-2026-53458
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20272 are related to issues with improper neutralization of special elements that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 34.8%
Affected Products (NVD)
VendorProductVersion
ciscoios_xe
16.6.2
ciscoios_xe
16.6.3
ciscoios_xe
16.6.4
ciscoios_xe
16.6.4a:a
ciscoios_xe
16.6.4s:s
ciscoios_xe
16.6.5
ciscoios_xe
16.6.5a:a
ciscoios_xe
16.6.5b:b
ciscoios_xe
16.6.6
ciscoios_xe
16.6.7
ciscoios_xe
16.6.7a:a
ciscoios_xe
16.6.8
ciscoios_xe
16.6.9
ciscoios_xe
16.6.10
ciscoios_xe
16.7.1
ciscoios_xe
16.7.1a:a
ciscoios_xe
16.7.1b:b
ciscoios_xe
16.7.2
ciscoios_xe
16.7.3
ciscoios_xe
16.7.4
ciscoios_xe
16.8.1
ciscoios_xe
16.8.1a:a
ciscoios_xe
16.8.1b:b
ciscoios_xe
16.8.1c:c
ciscoios_xe
16.8.1d:d
ciscoios_xe
16.8.1e:e
ciscoios_xe
16.8.1s:s
ciscoios_xe
16.8.2
ciscoios_xe
16.8.3
ciscoios_xe
16.9.1
ciscoios_xe
16.9.1a:a
ciscoios_xe
16.9.1b:b
ciscoios_xe
16.9.1c:c
ciscoios_xe
16.9.1d:d
ciscoios_xe
16.9.1s:s
ciscoios_xe
16.9.2
ciscoios_xe
16.9.2a:a
ciscoios_xe
16.9.2s:s
ciscoios_xe
16.9.3
ciscoios_xe
16.9.3a:a
ciscoios_xe
16.9.3h:h
ciscoios_xe
16.9.3s:s
ciscoios_xe
16.9.4
ciscoios_xe
16.9.4c:c
ciscoios_xe
16.9.5
ciscoios_xe
16.9.5f:f
ciscoios_xe
16.9.6
ciscoios_xe
16.9.7
ciscoios_xe
16.9.8
ciscoios_xe
16.9.8a:a
ciscoios_xe
16.9.8b:b
ciscoios_xe
16.10.1
ciscoios_xe
16.10.1a:a
ciscoios_xe
16.10.1b:b
ciscoios_xe
16.10.1c:c
ciscoios_xe
16.10.1d:d
ciscoios_xe
16.10.1e:e
ciscoios_xe
16.10.1f:f
ciscoios_xe
16.10.1g:g
ciscoios_xe
16.10.1s:s
ciscoios_xe
16.10.2
ciscoios_xe
16.10.3
ciscoios_xe
16.11.1
ciscoios_xe
16.11.1a:a
ciscoios_xe
16.11.1b:b
ciscoios_xe
16.11.1c:c
ciscoios_xe
16.11.1s:s
ciscoios_xe
16.11.2
ciscoios_xe
16.12.1
ciscoios_xe
16.12.1a:a
ciscoios_xe
16.12.1c:c
ciscoios_xe
16.12.1s:s
ciscoios_xe
16.12.1t:t
ciscoios_xe
16.12.1w:w
ciscoios_xe
16.12.1x:x
ciscoios_xe
16.12.1y:y
ciscoios_xe
16.12.1z:z
ciscoios_xe
16.12.1z1:z1
ciscoios_xe
16.12.1z2:z2
ciscoios_xe
16.12.2
ciscoios_xe
16.12.2a:a
ciscoios_xe
16.12.2s:s
ciscoios_xe
16.12.2t:t
ciscoios_xe
16.12.3
ciscoios_xe
16.12.3a:a
ciscoios_xe
16.12.3s:s
ciscoios_xe
16.12.4
ciscoios_xe
16.12.4a:a
ciscoios_xe
16.12.5
ciscoios_xe
16.12.5a:a
ciscoios_xe
16.12.5b:b
ciscoios_xe
16.12.6
ciscoios_xe
16.12.6a:a
ciscoios_xe
16.12.7
ciscoios_xe
16.12.8
ciscoios_xe
16.12.9
ciscoios_xe
16.12.10
ciscoios_xe
16.12.10a:a
ciscoios_xe
16.12.11
ciscoios_xe
16.12.12
ciscoios_xe
16.12.13
ciscoios_xe
16.12.14
ciscoios_xe
16.12.15
ciscoios_xe
16.12.16
ciscoios_xe
17.1.1
ciscoios_xe
17.1.1a:a
ciscoios_xe
17.1.1s:s
ciscoios_xe
17.1.1t:t
ciscoios_xe
17.1.2
ciscoios_xe
17.1.3
ciscoios_xe
17.2.1
ciscoios_xe
17.2.1a:a
ciscoios_xe
17.2.1r:r
ciscoios_xe
17.2.1v:v
ciscoios_xe
17.2.2
ciscoios_xe
17.2.3
ciscoios_xe
17.3.1
ciscoios_xe
17.3.1a:a
ciscoios_xe
17.3.1w:w
ciscoios_xe
17.3.1x:x
ciscoios_xe
17.3.1z:z
ciscoios_xe
17.3.2
ciscoios_xe
17.3.2a:a
ciscoios_xe
17.3.3
ciscoios_xe
17.3.3a:a
ciscoios_xe
17.3.4
ciscoios_xe
17.3.4a:a
ciscoios_xe
17.3.4b:b
ciscoios_xe
17.3.4c:c
ciscoios_xe
17.3.5
ciscoios_xe
17.3.5a:a
ciscoios_xe
17.3.5b:b
ciscoios_xe
17.3.6
ciscoios_xe
17.3.7
ciscoios_xe
17.3.8
ciscoios_xe
17.3.8a:a
ciscoios_xe
17.4.1
ciscoios_xe
17.4.1a:a
ciscoios_xe
17.4.1b:b
ciscoios_xe
17.4.1c:c
ciscoios_xe
17.4.2
ciscoios_xe
17.4.2a:a
ciscoios_xe
17.5.1
ciscoios_xe
17.5.1a:a
ciscoios_xe
17.6.1
ciscoios_xe
17.6.1a:a
ciscoios_xe
17.6.1x:x
ciscoios_xe
17.6.1z:z
ciscoios_xe
17.6.1z1:z1
ciscoios_xe
17.6.2
ciscoios_xe
17.6.3
ciscoios_xe
17.6.3a:a
ciscoios_xe
17.6.4
ciscoios_xe
17.6.5
ciscoios_xe
17.6.5a:a
ciscoios_xe
17.6.6
ciscoios_xe
17.6.6a:a
ciscoios_xe
17.6.7
ciscoios_xe
17.6.8
ciscoios_xe
17.6.8a:a
ciscoios_xe
17.7.1
ciscoios_xe
17.7.1a:a
ciscoios_xe
17.7.1b:b
ciscoios_xe
17.7.2
ciscoios_xe
17.8.1
ciscoios_xe
17.8.1a:a
ciscoios_xe
17.9.1
ciscoios_xe
17.9.1a:a
ciscoios_xe
17.9.1w:w
ciscoios_xe
17.9.1x:x
ciscoios_xe
17.9.1x1:x1
ciscoios_xe
17.9.1y:y
ciscoios_xe
17.9.1y1:y1
ciscoios_xe
17.9.2
ciscoios_xe
17.9.2a:a
ciscoios_xe
17.9.3
ciscoios_xe
17.9.3a:a
ciscoios_xe
17.9.4
ciscoios_xe
17.9.4a:a
ciscoios_xe
17.9.5
ciscoios_xe
17.9.5a:a
ciscoios_xe
17.9.5b:b
ciscoios_xe
17.9.5c:c
ciscoios_xe
17.9.5d:d
ciscoios_xe
17.9.5e:e
ciscoios_xe
17.9.5f:f
ciscoios_xe
17.9.6
ciscoios_xe
17.9.6a:a
ciscoios_xe
17.9.7
ciscoios_xe
17.9.7a:a
ciscoios_xe
17.9.7b:b
ciscoios_xe
17.9.8
ciscoios_xe
17.9.9
ciscoios_xe
17.10.1
ciscoios_xe
17.10.1a:a
ciscoios_xe
17.10.1b:b
ciscoios_xe
17.11.1
ciscoios_xe
17.11.1a:a
ciscoios_xe
17.12.1
ciscoios_xe
17.12.1a:a
ciscoios_xe
17.12.1w:w
ciscoios_xe
17.12.1x:x
ciscoios_xe
17.12.1y:y
ciscoios_xe
17.12.1z:z
ciscoios_xe
17.12.1z1:z1
ciscoios_xe
17.12.1z2:z2
ciscoios_xe
17.12.1z3:z3
ciscoios_xe
17.12.1z4:z4
ciscoios_xe
17.12.1z5:z5
ciscoios_xe
17.12.1z6:z6
ciscoios_xe
17.12.2
ciscoios_xe
17.12.2a:a
ciscoios_xe
17.12.3
ciscoios_xe
17.12.3a:a
ciscoios_xe
17.12.4
ciscoios_xe
17.12.4a:a
ciscoios_xe
17.12.4b:b
ciscoios_xe
17.12.5
ciscoios_xe
17.12.5a:a
ciscoios_xe
17.12.5b:b
ciscoios_xe
17.12.5c:c
ciscoios_xe
17.12.5d:d
ciscoios_xe
17.12.6
ciscoios_xe
17.12.6a:a
ciscoios_xe
17.12.6b:b
ciscoios_xe
17.12.7
ciscoios_xe
17.12.7a:a
ciscoios_xe
17.12.7b:b
ciscoios_xe
17.13.1
ciscoios_xe
17.13.1a:a
ciscoios_xe
17.14.1
ciscoios_xe
17.14.1a:a
ciscoios_xe
17.15.1
ciscoios_xe
17.15.1a:a
ciscoios_xe
17.15.1b:b
ciscoios_xe
17.15.1w:w
ciscoios_xe
17.15.1x:x
ciscoios_xe
17.15.1y:y
ciscoios_xe
17.15.2
ciscoios_xe
17.15.2a:a
ciscoios_xe
17.15.2b:b
ciscoios_xe
17.15.2c:c
ciscoios_xe
17.15.3
ciscoios_xe
17.15.3a:a
ciscoios_xe
17.15.3b:b
ciscoios_xe
17.15.4
ciscoios_xe
17.15.4a:a
ciscoios_xe
17.15.4b:b
ciscoios_xe
17.15.4c:c
ciscoios_xe
17.15.4d:d
ciscoios_xe
17.15.4s1:s1
ciscoios_xe
17.15.5
ciscoios_xe
17.15.5a:a
ciscoios_xe
17.15.7
ciscoios_xe
17.16.1
ciscoios_xe
17.16.1a:a
ciscoios_xe
17.17.1
ciscoios_xe
17.18.1a:a
ciscoios_xe
17.18.1w:w
ciscoios_xe
17.18.1x:x
ciscoios_xe
17.18.1y:y
ciscoios_xe
17.18.1z:z
ciscoios_xe
17.18.2
ciscoios_xe
17.18.3
ciscoios_xe
17.18.3a:a
ciscoios_xe
26.1.1
ciscoios_xe
26.1.1a:a
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ
https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification