Denial of Service Vulnerability in Cisco IOS and IOS XE Due to Improper Packet Handling

CVE-2026-20301

What is CVE-2026-20301?

A vulnerability exists within the Extensible Messaging Client Protocol (XMCP) utilized by Cisco IOS Software and Cisco IOS XE Software. This security flaw permits unauthenticated remote attackers to craft and send malformed XMCP packets to affected devices, leading them to unexpectedly reload and thereby inducing a denial of service (DoS) condition. The absence of the need for an XMCP client username simplifies the exploitation process, highlighting significant security concerns for networks utilizing affected Cisco products.

References