PT-2026-24729 · Cisco · Ios Xr

Published 2026-03-11 · Updated 2026-03-13 · CVE-2026-20046

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software (affected versions not specified)

Description A flaw exists in the task group assignment for a specific Command Line Interface (CLI) command within the software. This could allow an authenticated, local attacker to gain administrative control of a device. The issue stems from an incorrect mapping of a command to task groups in the source code. An attacker with limited privileges can bypass task group-based checks by using the CLI command, potentially elevating their privileges and performing unauthorized actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2026-05203

CVE-2026-20046

Affected Products

Ios Xr

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-20046 · Security Note
• https://bdu.fstec.ru/vul/2026-05203 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W · Vendor Advisory
• https://twitter.com/vuldb/status/2031880391477579877 · Twitter Post
• https://twitter.com/jbhall56/status/2032075119401553989 · Twitter Post
• https://twitter.com/TheHackerWire/status/2031783582843486260 · Twitter Post
• https://twitter.com/CCBalert/status/2032142245864804570 · Twitter Post
• https://twitter.com/CveFindCom/status/2031787649447399888 · Twitter Post
• https://t.me/CVEtracker/47136 · Telegram Post
• https://reddit.com/r/pwnhub/comments/1rrw3gg/cisco_patches_four_highseverity_ios_xr · Reddit Post
• https://twitter.com/the_yellow_fall/status/2031916666511102246 · Twitter Post
• https://twitter.com/CVEnew/status/2032410992467210246 · Twitter Post