Skip to content
VulniPulse
Sign in
Highest advisory severityCritical 1 vendor · 2 advisories

CVE-2026-20280

CVE-2026-20280 is covered by the cisco-sa-hardening-iosxr-qg64NcM security bulletin. Not in the CISA KEV catalog. Critical advisory severity.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Get an email when Cisco publishes the next one.

VulniPulse checks Cisco's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.

Start your free month

CVE-2026-20280 key facts

CISA KEV
Not listed (catalog checked )
Highest advisory severity
Critical
Vendor advisories
2 from Cisco
VulniPulse record
Published · Updated

Is CVE-2026-20280 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-20280 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-20280?

This CVE is tracked through a multi-CVE bulletin, so its fixed releases may differ from the bulletin-wide values below. Check the vendor source.

Vendor advisory comparison

Cisco

2 advisories
  • Advisory severityCritical9.8

    Critical [CVE-2026-20274 +6] Cisco IOS XR Software Security Hardening Release: September 2026

    cisco-sa-hardening-iosxr-qg64NcMSource published Source updated

    This bulletin covers 7 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these…

    Affected products in this advisory
    • IOS XR Software
    Source-reported affected versions
    • Scope: These vulnerabilities affect all releases of Cisco IOS XR Software, including Cisco IOS XR7 (LNT) Software, regardless of device configuration.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Workarounds
    • There are no workarounds that address these vulnerabilities.
    Full advisory and evidenceOpen source bulletin
  • Advisory severityUnrated

    Advisory [CVE-2026-20212 +10] Cisco Advance Notification for Publication of September 2, 2026, Security Advisories

    cisco-sa-notice-f2SiMFxlSource published Source updated

    This bulletin covers 11 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    On September 2, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco IOS XR Software Security Hardening Release: September 2026 Critical 9.8 Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability High 7.5 Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities Medium 5.9 To remediate the vulnerabilities that were disclosed on September 2, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more…

    Affected products in this advisory
    No product details extracted. Check the source bulletin.
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • On September 2, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Desk Phone 9800, 7800 and 8800, and 8875 Series Software IOS XR Software (security hardening release) Nexus 9000 Series Switches Silicon One Secure Email To fully remediate vulnerabilities to be disclosed on September 2, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.
    Full advisory and evidenceOpen source bulletin

More Cisco advisories

All Cisco advisories

Follow CVE-2026-20280 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Free, no account. Confirm by email; unsubscribe in one click. Choose vendors and severity

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Monitor future Cisco CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features