# CVE-2026-20074: Cisco IOS XR Software DoS in IS-IS Multi-Instance Routing

Source: https://junglewise.ai/threats/cve-2026-20074-cisco-ios-xr-software-dos-in-is-is-multi-instance-routing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-11. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-20074 · Severity: high · CVSS 7.4 · Published 2026-03-11

A vulnerability in Cisco's networking software for service provider routers could allow an attacker on the same local network to crash the routing process. This affects the IS-IS protocol, which is used to direct traffic across large networks. If exploited, the router would temporarily lose its ability to communicate with other parts of the network, leading to a service outage and potential disruption of customer internet or data services.

Technologies: [Cisco IOS XR Software](https://junglewise.ai/threats/technologies/ios-xr-software). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20074 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20074 being exploited in the wild.

**How severe is CVE-2026-20074?** High severity, with a CVSS score of 7.4, published 11 March 2026.

**Which products and versions are affected?** Cisco IOS XR Software 7.8.0 through 25.2.1, 25.3.0.

**Is there a fix for CVE-2026-20074?** A patch was published on 2026-03-11: Fixed versions 25.2.2 and 25.3.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20074 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-20074?** Check whether you run Cisco IOS XR Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the IS-IS multi-instance routing feature of Cisco IOS XR Software due to improper input validation of ingress IS-IS packets (CWE-1287). An unauthenticated attacker who is Layer 2-adjacent to the target device can exploit this by first forming a routing adjacency and then sending specifically crafted IS-IS packets. A successful exploit triggers an unexpected restart of the IS-IS process, causing a temporary loss of routing information and connectivity to advertised networks. The vulnerability specifically affects devices with 'instance-id' configured under the IS-IS router process. Cisco has released software updates and suggests configuring IS-IS area authentication as a mitigation to prevent unauthorized adjacency formation.

## Affected products

- Cisco IOS XR Software 7.8.0 through 25.2.1, 25.3.0

## Timeline

- 2026-03-11: advisory: Initial public release by Cisco
- 2026-03-11: patched: Fixed versions 25.2.2 and 25.3.1 released

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isis-dos-kDMxpSzK](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isis-dos-kDMxpSzK)

## Related threats

- [Cisco IOS XR Software improper exception handling](https://junglewise.ai/threats/cve-2026-20280-cisco-ios-xr-software-improper-exception-handling)
- [Cisco IOS XR Software improper access control](https://junglewise.ai/threats/cve-2026-20279-cisco-ios-xr-software-improper-access-control)
- [Cisco IOS XR Software protection mechanism failure](https://junglewise.ai/threats/cve-2026-20277-cisco-ios-xr-software-protection-mechanism-failure)
- [Cisco IOS XR Software control flow management vulnerability](https://junglewise.ai/threats/cve-2026-20276-cisco-ios-xr-software-control-flow-management-vulnerability)
- [Cisco IOS XR Software incorrect calculation vulnerability](https://junglewise.ai/threats/cve-2026-20275-cisco-ios-xr-software-incorrect-calculation-vulnerability)