cisco-sa-scp-dos-duAdXtCgMediumCVSS 6.5

Cisco IOS XE Software Secure Copy Protocol Server Denial of Service Vulnerability

Published
March 25, 2026
Last Modified
March 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-20083 →

📋 Description

A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated, local attacker with low privileges to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to improper handling of a malformed SCP request. An attacker could exploit this vulnerability by issuing a crafted command through SSH. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is part of the March 2026 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: March 2026 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75297"].

CVE-2026-20083 — Cisco IOS XE Software SCP Server Denial of Service Vulnerability (CVSS 3.1 6.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)

🎯 Affected products366

  • Cisco IOS XE Software
  • Cisco IOS XE Software 16.10.1
  • Cisco IOS XE Software 16.10.1a
  • Cisco IOS XE Software 16.10.1b
  • Cisco IOS XE Software 16.10.1c
  • Cisco IOS XE Software 16.10.1d
  • Cisco IOS XE Software 16.10.1e
  • Cisco IOS XE Software 16.10.1f
  • Cisco IOS XE Software 16.10.1g
  • Cisco IOS XE Software 16.10.1s
  • Cisco IOS XE Software 16.10.2
  • Cisco IOS XE Software 16.10.3
  • Cisco IOS XE Software 16.11.1
  • Cisco IOS XE Software 16.11.1a
  • Cisco IOS XE Software 16.11.1b
  • Cisco IOS XE Software 16.11.1c
  • Cisco IOS XE Software 16.11.1s
  • Cisco IOS XE Software 16.11.2
  • Cisco IOS XE Software 16.12.1
  • Cisco IOS XE Software 16.12.10
  • Cisco IOS XE Software 16.12.10a
  • Cisco IOS XE Software 16.12.11
  • Cisco IOS XE Software 16.12.12
  • Cisco IOS XE Software 16.12.13
  • Cisco IOS XE Software 16.12.14
  • Cisco IOS XE Software 16.12.1a
  • Cisco IOS XE Software 16.12.1c
  • Cisco IOS XE Software 16.12.1s
  • Cisco IOS XE Software 16.12.1t
  • Cisco IOS XE Software 16.12.1w
  • +336 more not shown

✅ Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com Workarounds: There are no workarounds that address this vulnerability. However, as a mitigation, administrators may disable the SCP server feature with the privilege EXEC CLI configuration command no ip scp server enable. While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

🔗 References (3)