# CVE-2026-20270: Cisco IOS XE Software incorrect calculation vulnerability

Source: https://junglewise.ai/threats/cve-2026-20270-cisco-ios-xe-software-incorrect-calculation-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-20270 · Severity: high · CVSS 8.6 · Published 2026-08-05

Cisco IOS XE Software contains multiple calculation and validation errors that were discovered during an internal security review. These vulnerabilities affect network switches and routing equipment running IOS XE in autonomous or controller mode. An attacker with network access could exploit these issues to cause crashes, data corruption, or other impacts depending on the specific flaw.

Technologies: [Cisco IOS XE](https://junglewise.ai/threats/technologies/ios-xe). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20270 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20270 being exploited in the wild.

**How severe is CVE-2026-20270?** High severity, with a CVSS score of 8.6, published 5 August 2026.

**Which products and versions are affected?** Cisco IOS XE 17.9 (before 17.9.10), 17.12 (before 17.12.8), 17.15 (before 17.15.6), 17.18 (before 17.18.4), 26.1 (before 26.1.2).

**Is there a fix for CVE-2026-20270?** A patch was published on 2026-08-05: Fixed releases available: 17.9.10, 17.12.8, 17.15.6, 17.18.4, 26.1.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20270 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-20270?** Check whether you run Cisco IOS XE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-20270 is a numeric calculation error (CWE-682) grouped with other vulnerabilities discovered during Cisco's internal security review of IOS XE Software. The vulnerability affects Cisco IOS XE running in autonomous or controller mode on network devices. The exact attack vector requires network access with no authentication or user interaction required. The flaw falls within a broader set of seven related vulnerabilities (CVE-2026-20267 through CVE-2026-20273) covering improper access control, buffer overflows, resource lifetime issues, calculation errors, control flow management, command injection, and input validation flaws. Fixes are available in patched releases: 17.9.10, 17.12.8, 17.15.6, 17.18.4/4a, and 26.1.2. No workarounds are available.

## Affected products

- Cisco IOS XE 17.9 (before 17.9.10), 17.12 (before 17.12.8), 17.15 (before 17.15.6), 17.18 (before 17.18.4), 26.1 (before 26.1.2)

## Timeline

- 2026-08-05: disclosed
- 2026-08-05: patched: Fixed releases available: 17.9.10, 17.12.8, 17.15.6, 17.18.4, 26.1.2

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ)
- [https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification](https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification)

## Related threats

- [Cisco Snort 3 Detection Engine denial of service in GTP codec](https://junglewise.ai/threats/cve-2026-76445-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 incorrect calculation vulnerability](https://junglewise.ai/threats/cve-2026-20236-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 out-of-bounds write](https://junglewise.ai/threats/cve-2026-20043-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco IOS XE Software improper input validation](https://junglewise.ai/threats/cve-2026-20273-cisco-ios-xe-software-improper-input-validation)
- [Cisco IOS XE Software improper neutralization of special elements](https://junglewise.ai/threats/cve-2026-20272-cisco-ios-xe-software-improper-neutralization-of-special-elements)