CVE-2026-20267 -- CVSS 9.0 Vulnerability Briefing

CVE-2026-20267 | CVSS 9.0 (Critical) | Exploit: PoC available

What Is It

CVE-2026-20267 is a critical improper access control vulnerability affecting Cisco IOS XE Software, identified as part of Cisco's internal security review and classified under CWE-284.

Technical Detail

The available advisory information describes this issue as an improper access control flaw but does not identify the affected IOS XE feature, interface, prerequisites, or attack vector. Cisco has not publicly specified whether successful exploitation enables authentication bypass, privilege escalation, remote code execution, or another security impact. The issue is addressed through Cisco IOS XE Software hardening releases.

Exploitation Status

A proof of concept is available. CVE-2026-20267 is not listed in CISA's Known Exploited Vulnerabilities Catalog, and active exploitation in the wild has not been confirmed.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Treat this as a priority patching issue because of its critical CVSS score and the availability of proof-of-concept exploit material. Identify Cisco IOS XE Software deployments, obtain and apply the applicable Cisco hardening release or other vendor-provided fixed software version, and verify successful installation. No workaround, affected feature details, or reliable detection indicators have been published in the available information; organizations should review Cisco security advisories and monitor IOS XE administrative access, configuration changes, and authentication events for anomalous activity.