CVE-2026-20124Cisco IOS XE Software SNMP Denial of Service Vulnerability
Updated under an hour ago ()
Does this affect you?
It affects Cisco IOS XE Software and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to improper error handling when parsing SNMP requests. This vulnerability affects all versions of SNMP — Versions 1, 2c, and 3. An attacker could exploit this vulnerability by sending a malformed SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly. The attacker must have the SNMPv1 or v2c read-only or read-write community string or valid SNMPv3 user credentials on the affected device.
- CVSS
- 7.7 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- Weakness (CWE)
- CWE-772
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- cisco
- NVD analysis
- Analyzed
- Record last updated
- Aug 5, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Cisco Cisco IOS XE Software cisco:ios_xe_software (from the name) | 17.2.1a; 3.18.7SP; 16.12.1y; 16.12.3s; 16.7.1b; 16.6.2; 16.6.5; 16.12.1w; and 193 more ranges | CNA record |
cisco ios_xe cisco:ios_xe | 3.13.9s; 3.13.10s; 3.16.6bs; 3.16.7as; 3.16.7bs; 3.16.7s; 3.16.8s; 3.16.9s; and 193 more ranges | NVD |
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-snmp-dos-ZAqNm4MDmitigation, vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.