> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Cisco searched for IOS XR bugs and found so many it rolled them into an update release - URL: https://f4n6.co.uk/security-feed/cisco-searched-for-ios-xr-bugs-and-found-so-many-it-rolled-them-into-an-update-release/ - Published: 2026-09-04T09:24:17.000Z - Updated: 2026-09-04T09:24:17.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-20274, CVE-2026-20279, CVE-2026-20212 ## 1\. Executive summary Cisco has disclosed three critical (CVSS 9.8) vulnerabilities following a comprehensive internal security review of IOS XR Software and a separate finding by its support organisation. Two of the flaws — CVE-2026-20274 (CWE-664) and CVE-2026-20279 (CWE-284, improper access control) — affect IOS XR, the operating system powering Cisco's carrier-grade routing platforms, and are fixed in a new IOS XR hardening release that bundles seven umbrella CVEs in total. The third, CVE-2026-20212 (CWE-1327), is an unauthenticated remote code execution with root privileges affecting ten Silicon One-based Nexus 9000 Series Switches, caused by TCP ports 43210 and 43211 being accessible in the default Layer 3 VRF — and critically, **no software fix exists yet**; only iACL mitigation is available. None of the three CVEs are in the CISA KEV catalogue and EPSS scores are low (0–1%), so there is no evidence of in-the-wild exploitation — but an internet-reachable root RCE on data-centre switching with no patch is a priority exposure regardless. EMEA financial services running Nexus 9000 (Silicon One) or IOS XR infrastructure should treat the Nexus exposure as P1. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The trigger test fails: this is a vendor disclosure with no confirmed incident, no exploitation, and no client-side event yet. If exploitation of CVE-2026-20212 is subsequently observed on a client device, DORA Art. 18 (classification of ICT-related incidents and cyber threats) and Art. 19 (reporting of major ICT-related incidents to competent authorities) would engage at that point — not before. ## 3\. Technical analysis & attack chain This is a patch-roundup-style disclosure covering seven umbrella CVEs in IOS XR plus one standalone Nexus 9000 flaw. Prioritised triage: | CVE | Component | CVSS | KEV/EPSS | Why it matters | | -------------- | ----------------------------------------------------------- | -------------------- | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | CVE-2026-20212 | Nexus 9000 (Silicon One), TCP 43210/43211 in default L3 VRF | 9.8 CRITICAL | Not in KEV / EPSS 1% | Unauthenticated remote root RCE; **no patch available**, iACL mitigation only | | CVE-2026-20274 | IOS XR | 9.8 CRITICAL | Not in KEV / EPSS 1% | Buffering issues, potential out-of-bounds writes, insecure default initialisation (CWE-664) | | CVE-2026-20279 | IOS XR | 9.8 CRITICAL | Not in KEV / EPSS 0% | Improper access control: improper certificate validation, missing authentication for critical function, missing/incorrect authorisation (CWE-284) | | CVE-2026-20275 | IOS XR | Not in verified data | Not in KEV | Incorrect calculation (CWE-682) — one row, umbrella hardening release | | CVE-2026-20276 | IOS XR | Not in verified data | Not in KEV | Insufficient control flow management (CWE-691) | | CVE-2026-20277 | IOS XR | Not in verified data | Not in KEV | Protection mechanism failure (CWE-693) | | CVE-2026-20278 | IOS XR | Not in verified data | Not in KEV | Improper neutralization (CWE-707) | | CVE-2026-20280 | IOS XR | Not in verified data | Not in KEV | Improper checking/handling of exceptional conditions (CWE-703) | The Register additionally reports "a trio of 8.8-rated flaws, plus another rated 8.6 and one more scored at 8.2" within the release; the verified reference data covers only the three 9.8s, so those scores are single-sourced to The Register and not itemised here. **CVE-2026-20212 — the urgent item.** Mechanism, per Cisco's advisory as reported: a bad integration between Nexus 9000 Series Switches and Cisco's own Silicon One networking processors leaves TCP ports **43210 and 43211 accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF)**. Attack chain as confirmed: 1. Attacker reaches an affected Nexus 9000 device over the network and can connect to TCP 43210 or 43211 in the default L3 VRF — no authentication required. 2. Attacker sends crafted input to the open service. 3. Crafted input is executed as code **with root privileges** on the switch. 4. Alternative failure mode: the crafted input crashes the **S1HAL process**, which causes the device to reload — a remote unauthenticated DoS on the same primitive. Ten Nexus 9000 devices are affected (per The Hacker News, Silicon One-based). Impact for a financial services data centre: root code execution on a top-of-rack or spine switch gives an attacker a pivot point for traffic interception, lateral movement, and control-plane manipulation; the crash path alone is a availability risk to trading/settlement-adjacent segments. No software update exists — Cisco "hasn't yet created a software update to fix the flaw once and for all," but has delivered a download that helps implement the mitigation. **CVE-2026-20274 / CVE-2026-20279 — IOS XR.** Both 9.8 CRITICAL, both found in Cisco's "comprehensive internal security review" (The Register speculates this may involve AI bug-finding models such as Mythos — that is vendor-speculation, not confirmed). CVE-2026-20274 groups buffering issues, potential out-of-bounds writes, and insecure default resource initialisation under CWE-664\. CVE-2026-20279 is an improper access control umbrella (CWE-284) covering improper certificate validation, missing authentication for critical function, missing authorisation, and incorrect authorisation. Per The Hacker News, the IOS XR hardening release bundles seven umbrella CVEs and there is **no workaround for any IOS XR version** — upgrade is the only remediation. The source material does not provide per-CVE exploit prerequisites (protocol, port, required configuration) for the IOS XR items; do not assume network-reachability equivalence with the Nexus flaw. **Confidence caveat:** technical detail for CVE-2026-20212 is corroborated across The Register and The Hacker News. The IOS XR umbrella CVEs' CWE mappings come from Cisco's GitHub-published advisories; their CVSS sub-scores and the 8.8/8.6/8.2 additional flaws are single-sourced (The Register). No exploit code, no observed exploitation, no threat actor attribution exists in any source — treat all three criticals as unexploited. ## 4\. Mitigation & containment ### P1 — within 24 hours (CVE-2026-20212, Nexus 9000 Silicon One) - Inventory: identify all Nexus 9000 Series Switches in estate, confirm which are Silicon One-based and among the ten affected models. - Apply infrastructure ACLs per Cisco's guidance: permit only required management and control-plane traffic destined to the affected device. - Alternatively/additionally, explicitly **deny all TCP packets destined to a locally configured IP address with destination port 43210 or 43211** in the iACL. Example structure (adapt to your addressing): `ip access-list extended INFRASTRUCTURE-IN deny tcp any host eq 43210 deny tcp any host eq 43211 permit ... (required management/control-plane traffic)` - Download and deploy Cisco's helper download that assists with implementing the mitigation (referenced in the advisory; obtain via Cisco support). - Verify from outside the management segment that TCP 43210/43211 are unreachable on every affected device — including from other internal VRFs if the default L3 VRF is transit-reachable. ### P2 — within 72 hours (IOS XR) - Identify all IOS XR devices (carrier-grade routing platforms) in estate, including those operated by connectivity/telco providers on your behalf. - Plan the upgrade to the new IOS XR hardening release. There is **no workaround for any IOS XR version** — patching is the only path. Cisco "strongly recommends" adoption. - Until patched, restrict management-plane exposure on IOS XR devices to trusted source ranges as general hygiene (this is not a workaround for the CVEs — it reduces attack surface only). ### P3 — within 7 days - Confirm Cisco's software fix for CVE-2026-20212 when released and schedule replacement of iACL mitigation with the patch; keep the iACL in place until then. - Fold the full umbrella set (CVE-2026-20275 through -20280, CWE-682/691/693/707/703) into the same IOS XR upgrade — one patch motion covers all seven. - Update asset inventory and third-party/network-provider contracts to reflect the affected versions. ## 5\. Indicators of compromise No indicators of compromise available in the source material. No exploitation has been observed and no attacker artefacts exist. **Behavioural indicators** (for monitoring, given no patch exists for CVE-2026-20212): | Behaviour | Where to observe | Confidence | | ----------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- | -------------------------------------------------------------- | | Inbound TCP connections to destination ports 43210 or 43211 on Nexus 9000 management/locally-configured IPs | NetFlow, perimeter firewall logs, switch ACL hit counters | High — ports are the confirmed attack surface | | Unexpected reload of an affected Nexus 9000; S1HAL process crash preceding reload | Device syslog, SNMP traps, NMS availability alerts | High — confirmed crash consequence in advisory | | Unauthenticated session establishment on 43210/43211 followed by anomalous exec activity | Switch device logs, AAA/TACACS logs | Medium — plausible given RCE primitive, not observed in source | ## 6\. Detection No file-based artefacts exist for this vulnerability class (network-reachable service flaws in switch firmware); YARA is not applicable. Sigma for the behavioural signal — connections to the vulnerable ports on affected switches: ```yaml title: Cisco Nexus 9000 CVE-2026-20212 - Connection to Vulnerable TCP Ports 43210/43211 id: 7c2f1a44-8b3e-4d19-9f6a-2e5c8d1b0a73 status: experimental description: > Detects network traffic to TCP ports 43210 or 43211 on locally configured IPs of Cisco Nexus 9000 Series Switches affected by CVE-2026-20212 (unauthenticated RCE, root privileges). These ports are accessible in the default L3 VRF and should be blocked by iACL mitigation. references: - https://www.theregister.com/security/2026/09/04/cisco-searched-for-ios-xr-bugs-and-found-so-many-it-rolled-them-into-an-update-release/5294410 - https://thehackernews.com/2026/09/critical-cisco-nexus-9000-flaw-lets.html author: Adverse Trace date: 2026-09-04 logsource: category: firewall detection: selection: dst_port: - 43210 - 43211 filter_optional_authorized: - "Permitted management traffic per iACL policy (tune per environment)" condition: selection and not 1 of filter_optional_authorized falsepositives: - Legitimate internal tooling using high ports; tune destination to affected switch IPs level: high ``` ## CVE assessment 3 referenced CVEs — 3 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-20274](https://nvd.nist.gov/vuln/detail/CVE-2026-20274?ref=f4n6.co.uk) | 9.8 Critical | — | 1% | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has… | | [CVE-2026-20279](https://nvd.nist.gov/vuln/detail/CVE-2026-20279?ref=f4n6.co.uk) | 9.8 Critical | — | 0% | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has… | | [CVE-2026-20212](https://nvd.nist.gov/vuln/detail/CVE-2026-20212?ref=f4n6.co.uk) | 9.8 Critical | — | 1% | A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote atta… | ## 7\. Sources - The Register — *Cisco searched for IOS XR bugs and found so many it rolled them into an update release* — https://www.theregister.com/security/2026/09/04/cisco-searched-for-ios-xr-bugs-and-found-so-many-it-rolled-them-into-an-update-release/5294410 — 2026-09-04 - The Hacker News — *Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root* — https://thehackernews.com/2026/09/critical-cisco-nexus-9000-flaw-lets.html — 2026-09 - GitHub Security Advisory GHSA-jp29-xjv5-g87x — Cisco IOS XR, CVE-2026-20275 (CWE-682) — https://github.com/advisories/GHSA-jp29-xjv5-g87x - GitHub Security Advisory GHSA-6p8v-vwv7-4vg4 — Cisco IOS XR, CVE-2026-20277 (CWE-693) — https://github.com/advisories/GHSA-6p8v-vwv7-4vg4 - GitHub Security Advisory GHSA-cf4p-9ff3-r3m3 — Cisco IOS XR, CVE-2026-20278 (CWE-707) — https://github.com/advisories/GHSA-cf4p-9ff3-r3m3 - GitHub Security Advisory GHSA-h893-gcq5-j4cv — Cisco IOS XR, CVE-2026-20280 (CWE-703) — https://github.com/advisories/GHSA-h893-gcq5-j4cv - GitHub Security Advisory GHSA-gg8h-54f3-9xqm — Cisco IOS XR, CVE-2026-20276 (CWE-691) — https://github.com/advisories/GHSA-gg8h-54f3-9xqm ## 8\. Adverse Trace position All three CVEs are CVSS 9.8 CRITICAL per NVD, but none are in CISA KEV and EPSS is 0–1% — no evidence of active exploitation, and we do not inflate severity beyond the verified data. The practical risk ranking inverts the EPSS numbers: CVE-2026-20212 is the item that matters to EMEA financial services clients because it is an unauthenticated remote root RCE on data-centre switching with **no vendor patch available**, and any internet- or internally-exposed Nexus 9000 (Silicon One) management interface is a standing exposure until iACLs are in place. The IOS XR items are serious but patchable now, with no workaround — clients should move to the hardening release on their normal critical-infrastructure change cycle, accelerated where IOS XR devices have broad management-plane exposure. Attribution and exploitation are entirely absent from the source material; nothing here is single-sourced except the IOS XR sub-9.8 flaw scores (The Register only). We will monitor for a Cisco software fix for CVE-2026-20212, for any KEV listing or EPSS movement on all three criticals, and for proof-of-concept code in public repositories; clients with Cisco estate should report affected-device counts to their Adverse Trace contact for exposure tracking. --- [Read the original source →](https://www.theregister.com/security/2026/09/04/cisco-searched-for-ios-xr-bugs-and-found-so-many-it-rolled-them-into-an-update-release/5294410?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*