CVE-2026-20004
Raw vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-20004 is a high-severity Missing Reference to Active Allocated Resource (CWE-771) vulnerability in Cisco IOS XE (inferred from references). Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-20004 is a vulnerability in the TLS library of Cisco IOS XE Software that stems from improper management of memory resources during TLS connection setup. This flaw, classified under CWE-771, enables an unauthenticated, adjacent attacker to exhaust the available memory on an affected device, with a CVSS v3.1 base score of 7.4 (AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
An adjacent attacker can exploit this vulnerability by repeatedly triggering memory-increasing conditions, such as attempting Extensible Authentication Protocol (EAP) authentication when local EAP is enabled on the device or conducting a machine-in-the-middle attack to reset TLS connections between the device and other systems. Successful exploitation leads to memory exhaustion, causing an unexpected reload and a denial-of-service (DoS) condition on the affected device.
For mitigation details, including available patches and workarounds, refer to the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-tls-dos-TVgLDEZL.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15426
Vulnerability Data
A vulnerability in the TLS library of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust the available memory of an affected device. This vulnerability is due to improper management of memory resources during TLS connection setup.…
more
An attacker could exploit this vulnerability by repeatedly triggering the conditions that cause the memory increase. This could be done in a variety of ways, such as by repeatedly attempting Extensible Authentication Protocol (EAP) authentication when local EAP is enabled on an affected device or by using a machine-in-the-middle attack and resetting TLS connections between the affected device and other devices. A successful exploit could allow the attacker to exhaust the available memory on an affected device, resulting in an unexpected reload and a denial of service (DoS) condition.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V7.4.5
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing references to allocated resources through dynamic analysis or fuzzing.
Requiring a documented development process and standards can mandate use of safe resource-management idioms and tools.
Security engineering principles include disciplined resource allocation and deallocation patterns that stop lost references from being introduced.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices directly prevent lost resource references via coding standards, reviews, and tooling.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing references to allocated resources before deployment.
Secure development lifecycle practices can include resource-management rules that prevent missing references.
Secure system architecture principles can mandate explicit resource tracking and release mechanisms.
Secure coding standards can require proper reference maintenance for allocated resources.
Configuration management can enforce proper tracking of allocated resources and their references.