cisco-sa-ios-xmcp-thbAr34tHighCVSS 8.6

Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability

Published
August 5, 2026
Last Modified
August 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-20301 →

📋 Description

A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to improper handling of malformed XMCP packets. An attacker could exploit this vulnerability by sending a malformed XMCP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition. The attacker does not need the XMCP client username to exploit this vulnerability.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. There is a mitigation that addresses this vulnerability.

CVE-2026-20301 — Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability (CVSS 3.1 8.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)

🎯 Affected products541

  • Cisco IOS
  • Cisco IOS XE Software
  • Cisco IOS 12.2(6)I1
  • Cisco IOS 15.2(1)SY5
  • Cisco IOS 15.2(1)SY6
  • Cisco IOS 15.2(1)SY7
  • Cisco IOS 15.2(1)SY8
  • Cisco IOS 15.2(2)E10
  • Cisco IOS 15.2(2)E10a
  • Cisco IOS 15.2(2)E10b
  • Cisco IOS 15.2(2)E10c
  • Cisco IOS 15.2(2)E8
  • Cisco IOS 15.2(2)E9
  • Cisco IOS 15.2(2)E9a
  • Cisco IOS 15.2(4)E10
  • Cisco IOS 15.2(4)E10a
  • Cisco IOS 15.2(4)E10b
  • Cisco IOS 15.2(4)E10c
  • Cisco IOS 15.2(4)E10d
  • Cisco IOS 15.2(4)E10e
  • Cisco IOS 15.2(4)E5
  • Cisco IOS 15.2(4)E6
  • Cisco IOS 15.2(4)E7
  • Cisco IOS 15.2(4)E8
  • Cisco IOS 15.2(4)E9
  • Cisco IOS 15.2(4)EA6
  • Cisco IOS 15.2(4)EA7
  • Cisco IOS 15.2(4)EA8
  • Cisco IOS 15.2(4)EA9
  • Cisco IOS 15.2(4)EA9a
  • +511 more not shown

✅ Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com Workarounds: There are no workarounds that address this vulnerability. However, as a mitigation, administrators may configure an access control allow list to allow only clients that match the specified access list to connect. All other clients will be denied. In the following example configuration, only host 192.168.1.1 is allowed to connect. service-routing xmcp listen allow-list ipv4 XMCPClientListIPv4 client username test_xmcp password <removed> ! ip access-list extended XMCPClientListIPv4 permit tcp host 192.168.1.1 any While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

🔗 References (2)