Is CVE-2026-20301 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20301 being exploited in the wild.

How severe is CVE-2026-20301?

High severity, with a CVSS score of 8.6, published 5 August 2026.

Which products and versions are affected?

Cisco Ios Software Multiple versions with XMCP Server feature enabled (see Cisco Software Checker for specific releases); Cisco IOS XE Software Multiple versions with XMCP Server feature enabled (see Cisco Software Checker for specific releases).

Is there a fix for CVE-2026-20301?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-20301 attacked?

It is attacked over the network.

Am I affected by CVE-2026-20301?

Check whether you run Cisco Ios Software or Cisco IOS XE Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20301: Cisco IOS and IOS XE denial of service in XMCP

CVE-2026-20301 · Severity: high · CVSS 8.6 · Published 2026-08-05

Cisco IOS and IOS XE devices with the XMCP (Extensible Messaging Client Protocol) Server feature enabled are vulnerable to remote denial of service attacks. An unauthenticated attacker can send a specially crafted network packet to cause the affected router or switch to crash and restart, disrupting all network traffic passing through that device. This vulnerability requires no authentication or user interaction.

Technologies: Cisco Ios Software, Cisco IOS XE Software. Vendors: Cisco.

Quick answers

Is CVE-2026-20301 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20301 being exploited in the wild.
How severe is CVE-2026-20301?: High severity, with a CVSS score of 8.6, published 5 August 2026.
Which products and versions are affected?: Cisco Ios Software Multiple versions with XMCP Server feature enabled (see Cisco Software Checker for specific releases); Cisco IOS XE Software Multiple versions with XMCP Server feature enabled (see Cisco Software Checker for specific releases).
Is there a fix for CVE-2026-20301?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20301 attacked?: It is attacked over the network.
Am I affected by CVE-2026-20301?: Check whether you run Cisco Ios Software or Cisco IOS XE Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability exists in the XMCP (Extensible Messaging Client Protocol, also called External Client protocol) implementation of Cisco IOS and IOS XE Software due to improper validation of malformed XMCP packets (CWE-606). An unauthenticated, remote attacker can exploit this by sending a crafted XMCP packet to a device with the XMCP Server feature enabled (configured via the "service-routing xmcp listen" command). A successful exploit causes the affected device to reload unexpectedly, resulting in a complete denial of service for all traffic transiting that device. No valid XMCP client credentials or prior access is required. Patches are available; Cisco also provides a temporary mitigation using access control lists to restrict XMCP connections to trusted clients only.

Affected products

Cisco IOS Software Multiple versions with XMCP Server feature enabled (see Cisco Software Checker for specific releases)
Cisco IOS XE Software Multiple versions with XMCP Server feature enabled (see Cisco Software Checker for specific releases)

Timeline

2026-08-05: disclosed: Vulnerability disclosed by Cisco

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xmcp-thbAr34t

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.