CVE-2026-20308: Cisco IOS XE Software Web-Based Management Interface Vulnerability

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-05 · updated 2026-10-23
Weakness: CWE-269

Description

A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to perform a denial of service (DoS) attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the web-based management interface to become unresponsive.

Affected products

Cisco IOS XE: 17.2.1a, 16.12.1y, 16.12.3s, 16.12.1w, 16.9.1d, 17.3.1 (+233)

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-dos-qdc7qx3

Get alerted when CVE-2026-20308 or the next vulnerability affects your stack