# CVE-2026-20046: Cisco IOS XR Software privilege escalation in task group assignment

Source: https://junglewise.ai/threats/cve-2026-20046-cisco-ios-xr-software-privilege-escalation-in-task-group  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-11. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-20046 · Severity: high · CVSS 8.8 · Published 2026-03-11

A vulnerability in Cisco IOS XR Software, used in high-end networking routers, could allow a user with low-level access to gain full administrative control of the device. By running a specific command that was incorrectly restricted, an attacker can bypass security checks to perform unauthorized actions. This could lead to a complete takeover of the router, potentially impacting network traffic and data security.

Technologies: [Cisco IOS XR](https://junglewise.ai/threats/technologies/ios-xr), [Cisco IOS XR Software](https://junglewise.ai/threats/technologies/ios-xr-software). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20046 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20046 being exploited in the wild.

**How severe is CVE-2026-20046?** High severity, with a CVSS score of 8.8, published 11 March 2026.

**Which products and versions are affected?** Cisco IOS XR Software All versions prior to 25.2.2.

**Is there a fix for CVE-2026-20046?** A patch was published on 2026-03-11: Fixed software releases made available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20046 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-20046?** Check whether you run Cisco IOS XR, Cisco IOS XR Software, Cisco IOS XRv 9000 Router or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software (specifically affecting IOS XRv 9000 Routers) could allow an authenticated, local attacker to elevate privileges. The root cause is an incorrect mapping of a specific command to task groups within the source code, which fails to enforce proper authorization checks. An attacker with low-privileged access can execute this specific command to bypass task group-based restrictions and gain full administrative control. Cisco has released software updates to address this issue, with version 25.2.2 being the first fixed release for the 25.2 branch. A workaround is available for environments using TACACS+ AAA command authorization to explicitly deny access to the affected command.

## Affected products

- Cisco IOS XR Software All versions prior to 25.2.2
- Cisco IOS XRv 9000 Routers

## Timeline

- 2026-03-11: advisory: Initial advisory published by Cisco
- 2026-03-11: patched: Fixed software releases made available

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W)

## Related threats

- [Cisco IOS XR IPv4 packet processing denial of service](https://junglewise.ai/threats/cve-2026-76505-a-vulnerability-in-the-ipv4-packet-processing-functionality-of)
- [Cisco IOS XR Software improper exception handling](https://junglewise.ai/threats/cve-2026-20280-cisco-ios-xr-software-improper-exception-handling)
- [Cisco IOS XR Software improper access control](https://junglewise.ai/threats/cve-2026-20279-cisco-ios-xr-software-improper-access-control)
- [Cisco IOS XR Software improper neutralization in command processing](https://junglewise.ai/threats/cve-2026-20278-cisco-ios-xr-software-improper-neutralization-in-command)
- [Cisco IOS XR Software protection mechanism failure](https://junglewise.ai/threats/cve-2026-20277-cisco-ios-xr-software-protection-mechanism-failure)