Read the docs
TI-2026-78845 Aliases CVE-2026-76505GHSA-5c8p-wwqr-9h22

Denial of service in Cisco IOS XR on ASR 9000 routers via IPv4 packets

Priority LOW 39CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Cisco IOS XR Software on Cisco ASR 9000 and 9900 Series Aggregation Services Routers and ASR 9902 and 9903 Compact High-Performance Routers mishandles crafted IPv4 packets received on a line card interface and processed as for-us traffic (CWE-20). An unauthenticated remote attacker can send such packets to cause network processor errors, resetting or shutting down the line card and causing denial of service. Repeated resets may leave the network processor shut down, which requires an explicit line card reload to restore traffic. Transit IPv4 traffic and IPv6 traffic do not trigger the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause network processor (NP) errors, resulting in a line card reset or shutdown and a denial of service (DoS) condition.  This vulnerability is due to the incorrect handling of crafted IPv4 packets that are received on an affected line card interface and processed as for-us traffic. The issue can result in an NP reset, causing traffic loss on the affected line card while it recovers. Under repeated reset conditions, the network processor may enter a persistent shutdown state, in which case an explicit line card reload may be required to restore traffic. The vulnerability is within the IPv4 packet-processing path. Transit IPv4 traffic does not trigger this issue and IPv6 traffic cannot trigger it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00468 40th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco IOS XR Software7.0.1; 7.1.1; 7.0.90; 6.7.1; 7.0.2; 7.1.15; 7.1.2; 6.7.2; 7.1.25; 7.1.3; 6.7.3; 7.3.1; 7.4.1; 6.8.1; 7.3.2; 7.5.1; 7.6.1; 7.5.2; 7.3.3; 6.8.2; 7.7.1; 7.4.2; 7.3.4; 6.7.35; 6.9.1; 7.6.2; 7.8.1; 7.5.3; 7.7.2; 6.9.2; 7.9.1; 7.8.2; 7.5.4; 7.8.22; 7.10.1; 7.9.2; 7.3.5; 7.5.5; 7.11.1; 7.9.21; 7.10.2; 24.1.1; 7.11.2; 24.2.1; 24.1.2; 24.3.1; 24.4.1; 24.2.2; 7.8.23; 7.11.21; 24.3.2; 24.3.20; 24.3.30—No fix listedCNA
  • Cisco IOS XR Software VendorCisco Affected 7.0.1; 7.1.1; 7.0.90; 6.7.1; 7.0.2; 7.1.15; 7.1.2; 6.7.2; 7.1.25; 7.1.3; 6.7.3; 7.3.1; 7.4.1; 6.8.1; 7.3.2; 7.5.1; 7.6.1; 7.5.2; 7.3.3; 6.8.2; 7.7.1; 7.4.2; 7.3.4; 6.7.35; 6.9.1; 7.6.2; 7.8.1; 7.5.3; 7.7.2; 6.9.2; 7.9.1; 7.8.2; 7.5.4; 7.8.22; 7.10.1; 7.9.2; 7.3.5; 7.5.5; 7.11.1; 7.9.21; 7.10.2; 24.1.1; 7.11.2; 24.2.1; 24.1.2; 24.3.1; 24.4.1; 24.2.2; 7.8.23; 7.11.21; 24.3.2; 24.3.20; 24.3.30 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*——Cisco
  • cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:* Versions — — ·Cisco

Remediation

The sources list no fixed version for Cisco IOS XR Software.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-76505
  2. 2026-10-21 Alias added: GHSA-5c8p-wwqr-9h22
  3. 2026-10-22 CISA SSVC decision points changed
  4. 2026-10-22 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2026-74174 Arbitrary file write in Cisco Secure Email Gateway via AMP feature KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53490 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53489 Cisco Secure Email Gateway SQL Injection Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53488 Cisco Identity Services Engine Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-16388 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-16344 Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0
See all 7059 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences