DHCP Snooping Vulnerability in Cisco IOS XE for Catalyst 9000 Series Switches

CVE-2026-20084

What is CVE-2026-20084?

A flaw in the DHCP snooping feature of Cisco IOS XE Software may allow an unauthenticated, remote attacker to forward BOOTP packets between VLANs. This vulnerability arises from improper handling of BOOTP packets on Cisco Catalyst 9000 Series Switches, enabling potential attackers to send BOOTP request packets to the affected device. Exploiting this vulnerability could result in BOOTP VLAN leakage and lead to high CPU utilization, rendering the device unresponsive and unable to forward network traffic, ultimately causing a denial of service condition. The threat can be realized using both unicast and broadcast BOOTP packets. Workarounds are available to mitigate this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References