What’s Vulnerable › Products

Cisco IOS XR Software vulnerabilities

212 known vulnerabilities, 10 confirmed exploited in the wild (CISA KEV), 32 published in the last 12 months.

Check whether your Cisco IOS XR Software version is affected

Exploited Cisco IOS XR Software vulnerabilities

• CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability
• CVE-2016-6415 — Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability
• CVE-2022-20821 — Cisco IOS XR Open Port Vulnerability
• CVE-2010-3035 — Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
• CVE-2009-2055 — Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
• CVE-2018-0175 — Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
• CVE-2018-0167 — Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
• CVE-2020-3569 — Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
• CVE-2020-3566 — Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
• CVE-2020-3118 — Cisco IOS XR Software Discovery Protocol Format String Vulnerability

Latest Cisco IOS XR Software vulnerabilities

• CVE-2026-76505 — Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability (CVSS 7.5)
• CVE-2026-20280 — Cisco IOS XR Software Security Hardening Release: September 2026 (CVSS 8.8)
• CVE-2026-20279 — Cisco IOS XR Software Security Hardening Release: September 2026 (CVSS 9.8)
• CVE-2026-20278 — Cisco IOS XR Software Security Hardening Release: September 2026 (CVSS 8.8)
• CVE-2026-20277 — Cisco IOS XR Software Security Hardening Release: September 2026 (CVSS 8.2)
• CVE-2026-20276 — Cisco IOS XR Software Security Hardening Release: September 2026 (CVSS 8.6)
• CVE-2026-20275 — Cisco IOS XR Software Security Hardening Release: September 2026 (CVSS 8.8)
• CVE-2026-20274 — Cisco IOS XR Software Security Hardening Release: September 2026 (CVSS 9.8)
• CVE-2026-20118 — Cisco IOS-XR NCS 5500 and NCS 5700 Egress Packet Network Interfaces Aligner Interrupt Denial of Service Vulnerability (CVSS 6.8)
• CVE-2026-20074 — Cisco IOS XR Software Multi-Instance Intermediate System-to-Intermediate System Denial of Service Vulnerability (CVSS 7.4)
• CVE-2026-20046 — Cisco IOS XR Software CLI Privilege Escalation Vulnerability (CVSS 8.8)
• CVE-2026-20040 — Cisco IOS XR Software CLI Privilege Escalation Vulnerability (CVSS 8.8)
• CVE-2025-20363 — (CVSS 9.0)
• CVE-2025-20340 — Cisco IOS XR Address Resolution Protocol Broadcast Storm Vulnerability (CVSS 7.4)
• CVE-2025-20248 — Cisco IOS XR Software Image Verification Bypass Vulnerability (CVSS 6.0)
• CVE-2025-20159 — Cisco IOS XR Software Management Interface ACL Bypass Vulnerability (CVSS 5.3)
• CVE-2025-20154 — Cisco IOS, IOS XE and IOS XR Software TWAMP Denial of Service Vulnerability (CVSS 8.6)
• CVE-2025-20209 — Cisco IOS XR Software Internet Key Exchange Version 2 Denial of Service Vulnerability (CVSS 7.5)
• CVE-2025-20177 — Cisco IOS XR Software Image Verification Bypass Vulnerability (CVSS 6.7)
• CVE-2025-20146 — Cisco IOS XR Software for ASR 9000 Series Routers Layer 3 Multicast Routing Denial of Service Vulnerability (CVSS 8.6)
• CVE-2025-20145 — Cisco IOS XR Software Access Control List Bypass Vulnerability (CVSS 5.8)
• CVE-2025-20144 — Cisco IOS XR Software Access Control List Bypass Vulnerability (CVSS 5.8)
• CVE-2025-20143 — Cisco IOS XR Software Secure Boot Bypass Vulnerability (CVSS 6.7)
• CVE-2025-20142 — Cisco IOS XR Software for ASR 9000 Series Routers L2VPN Denial of Service Vulnerability (CVSS 8.6)
• CVE-2025-20141 — Cisco IOS XR Software Release 7.9.2 Denial of Service Vulnerabillity (CVSS 7.4)