CVE-2026-20270

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20270 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-682.

Scoring

Severity

HIGH

CVSS base score

8.6

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS probability

0.28%

CWE

CWE-682

Published

2026-08-05

Last modified

2026-08-14

Affected products

• Cisco Cisco IOS XE Software
• Cisco Cisco IOS XE Software
• Cisco Cisco IOS XE Software
• Cisco Cisco IOS XE Software
• Cisco Cisco IOS XE Software
• Cisco Cisco IOS XE Software
• Cisco Cisco IOS XE Software
• Cisco Cisco IOS XE Software

Weakness type

• CWE-682

Related vulnerabilities

• CVE-2026-86736 — snipe-it before 8.7.0 Checkout Request Counter Integrity Failure
• CVE-2026-53706 — PREVAIL: ALU32 pointer arithmetic accepted without is64 gate — verifier emits false PASS for pointer-corrupting programs
• CVE-2026-53670 — PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification
• CVE-2026-53671 — PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification
• CVE-2026-20275 — Cisco IOS XR Software Security Hardening Release: September 2026
• CVE-2026-54754 — Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)
• CVE-2026-76043 — Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to...
• CVE-2026-71479 — New API: Integer overflow in quota billing yields negative charges (self-crediting)

Markdown version · Browse all CVEs