Security feed

24 October 2026

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash. CISA required action: Apply updates per vendor instructions.

IOS XR CVE-2020-3569

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2020-3569

IOS XR

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2020-3569
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3531 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:36:31 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

IOS XR CVE-2020-3566

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2020-3566

IOS XR

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2020-3566
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3529 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:36:30 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Cisco IOS XR Software Discovery Protocol Format String Vulnerability

Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device. CISA required action: Apply updates per vendor instructions.

IOS XR CVE-2020-3118

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2020-3118

IOS XR

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2020-3118
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3528 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:36:29 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS). CISA required action: Apply updates per vendor instructions.

IOS XR CVE-2009-2055

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2009-2055

IOS XR

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2009-2055
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2748 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:23:49 GMT
Publisher date: Fri, 25 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS). CISA required action: Apply updates per vendor instructions.

IOS XR CVE-2010-3035

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2010-3035

IOS XR

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2010-3035
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2746 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:23:48 GMT
Publisher date: Fri, 25 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Cisco IOS XR Open Port Vulnerability

Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container. CISA required action: Apply updates per vendor instructions.

IOS XR CVE-2022-20821

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2022-20821

IOS XR

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2022-20821
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2573 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:20:29 GMT
Publisher date: Mon, 23 May 2022 00:00:00 GMT

Read the original announcement