Cisco IOS XR up to 25.1.2 Egress Packet Network Interface Aligner cleanup

Summaryinfo

A vulnerability was found in Cisco IOS XR. It has been rated as critical. This impacts an unknown function of the component Egress Packet Network Interface Aligner. Performing a manipulation results in cleanup. This vulnerability is cataloged as CVE-2026-20118. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in Cisco IOS XR. This affects an unknown function of the component Egress Packet Network Interface Aligner. The manipulation with an unknown input leads to a cleanup vulnerability. CWE is classifying the issue as CWE-460. The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow. This is going to have an impact on availability. The summary by CVE is:

A vulnerability in the handling of an Egress Packet Network Interface (EPNI) Aligner interrupt in Cisco IOS XR Software for Cisco Network Convergence System (NCS) 5500 Series with NC57 line cards and Cisco NCS 5700 Routers and Cisco IOS XR Software for Third Party Software could allow an unauthenticated, remote attacker to cause the network processing unit (NPU) and ASIC to stop processing, preventing traffic from traversing the interface. This vulnerability is due to the corruption of packets in specific cases when an EPNI Aligner interrupt is triggered while an affected device is experiencing heavy transit traffic. An attacker could exploit this vulnerability by sending a continuous flow of crafted packets to an interface of the affected device. A successful exploit could allow the attacker to cause persistent, heavy packet loss, resulting in a denial of service (DoS) condition. Note: If active exploitation of this vulnerability is suspected, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider. Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. This change was made because the affected device operates within a critical network segment where compromise could lead to significant disruption or exposure, thereby elevating the overall risk beyond the base technical severity.

The advisory is shared at sec.cloudapps.cisco.com. This vulnerability is uniquely identified as CVE-2026-20118 since 10/08/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/14/2026).

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-11224) and CERT Bund (WID-SEC-2026-0706). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Cisco IOS XR

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XR

Version

• 7.9.1
• 7.9.2
• 7.10.1
• 7.10.2
• 7.11.1
• 7.11.2
• 7.11.21
• 24.1.1
• 24.1.2
• 24.2.1
• 24.2.2
• 24.2.11
• 24.2.20
• 24.2.21
• 24.3.1
• 24.3.2
• 24.3.20
• 24.3.30
• 24.4.1
• 24.4.2
• 24.4.30
• 25.1.1
• 25.1.2

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion