Is CVE-2026-20046 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20046 being exploited in the wild.

How severe is CVE-2026-20046?

High severity, with a CVSS score of 8.8, published 11 March 2026.

Which products and versions are affected?

Cisco IOS XR Software All versions prior to 25.2.2.

Is there a fix for CVE-2026-20046?

A patch was published on 2026-03-11: Fixed software releases made available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-20046 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-20046?

Check whether you run Cisco IOS XR, Cisco IOS XR Software, Cisco IOS XRv 9000 Router or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20046: Cisco IOS XR Software privilege escalation in task group assignment

CVE-2026-20046 · Severity: high · CVSS 8.8 · Published 2026-03-11

A vulnerability in Cisco IOS XR Software, used in high-end networking routers, could allow a user with low-level access to gain full administrative control of the device. By running a specific command that was incorrectly restricted, an attacker can bypass security checks to perform unauthorized actions. This could lead to a complete takeover of the router, potentially impacting network traffic and data security.

Technologies: Cisco IOS XR, Cisco IOS XR Software. Vendors: Cisco.

Quick answers

Is CVE-2026-20046 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20046 being exploited in the wild.
How severe is CVE-2026-20046?: High severity, with a CVSS score of 8.8, published 11 March 2026.
Which products and versions are affected?: Cisco IOS XR Software All versions prior to 25.2.2.
Is there a fix for CVE-2026-20046?: A patch was published on 2026-03-11: Fixed software releases made available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20046 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-20046?: Check whether you run Cisco IOS XR, Cisco IOS XR Software, Cisco IOS XRv 9000 Router or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software (specifically affecting IOS XRv 9000 Routers) could allow an authenticated, local attacker to elevate privileges. The root cause is an incorrect mapping of a specific command to task groups within the source code, which fails to enforce proper authorization checks. An attacker with low-privileged access can execute this specific command to bypass task group-based restrictions and gain full administrative control. Cisco has released software updates to address this issue, with version 25.2.2 being the first fixed release for the 25.2 branch. A workaround is available for environments using TACACS+ AAA command authorization to explicitly deny access to the affected command.

Affected products

Cisco IOS XR Software All versions prior to 25.2.2
Cisco IOS XRv 9000 Routers

Timeline

2026-03-11: advisory: Initial advisory published by Cisco
2026-03-11: patched: Fixed software releases made available

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.