Cisco IOS XE Software Denial of Service Vulnerability
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because incorrect privileges are associated with the start maintenance command. An attacker could exploit this vulnerability by accessing the management CLI of the affected device as a low-privileged user and using the start maintenance command. A successful exploit could allow the attacker to put the device in maintenance mode, which shuts down interfaces, resulting in a denial of service (DoS) condition. In case of exploitation, a device administrator can connect to the CLI and use the stop maintenance command to restore operations. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-mntc-dos-LZweQcyq This advisory is part of the March 2026 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: March 2026 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication . Security Impact Rating: Medium CVE: CVE-2026-20110
CSIRTS triage
- What
- A vulnerability in the CLI could allow a local attacker to cause a denial of service condition.
- Who is affected
- Authenticated local users of affected Cisco devices.
- Urgency
- Remediation is necessary to prevent potential service outages.
- Action
- Apply the software updates released by Cisco.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Cisco IOS XE Software
Get an email when a new Cisco IOS XE Software advisory drops — max one per day, one-click unsubscribe.
Details
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-201100.09% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-20110 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Cisco IOS XE
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalexploitedCVE-2025-20352: Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerabilitycisa-kev · 2025-09-29
- criticalexploitedCVE-2023-20273: Cisco IOS XE Web UI Command Injection Vulnerabilitycisa-kev · 2023-10-23
- unknownexploited[Update] Multiple vulnerabilities in Cisco IOS XE (October 17, 2023)cert-fr-alerte · 2023-10-17
- criticalexploitedCVE-2023-20198: Cisco IOS XE Web UI Privilege Escalation Vulnerabilitycisa-kev · 2023-10-16
- criticalexploitedCVE-2023-20109: Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerabilitycisa-kev · 2023-10-10
- criticalexploitedCVE-2016-6415: Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerabilitycisa-kev · 2023-05-19
More from Cisco Security Advisories
- unknownCisco Advance Notification for Publication of July 15, 2026, Security Advisories2026-07-08
- criticalCisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities2026-07-06
- highCisco Catalyst Center Arbitrary File Read Vulnerability2026-07-06
- highClamAV Vulnerabilities Affecting Cisco Products: July 20262026-07-02
- highCisco Advance Notification for Publication of July 1, 2026, Security Advisories2026-07-01