CVE-2026-20301: A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an

highCVSS 8.6CVE-2026-20301

A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of malformed XMCP packets. An attacker could exploit this vulnerability by sending a malformed XMCP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition. The attacker does not need the XMCP client username to exploit this vulnerability.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 8.6
Published: 2026-08-05
Last updated: 2026-08-06
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-20301

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-203010.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-20301	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] Cisco IOS: Vulnerability Enables Denial of Servicecert-bund
unknownCisco Products Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in Cisco products (August 6, 2026)cert-fr-avis
criticalCisco Advance Notification for Publication of August 5, 2026, Security Advisoriescisco-psirt
highCisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerabilitycisco-psirt

Recent advisories for Extensible Messaging Client

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerabilitycisco-psirt · 2026-08-05
unknownCVE-2026-54464: ### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSoc…nvd · 2026-07-17