CVE-2026-20263

Cisco Ios Xe 16.10.1 … 26.2.1ea

Published

05 August 2026

Modified

28 September 2026

Patch / advisory

View advisory

CVSS Score v3.1 8.6

Click a component to see what it means

Raw vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS Score 0.0057 45th percentile

Risk Priority 62 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-20263 is a high-severity an unspecified weakness vulnerability in Cisco Ios Xe. Its CVSS base score is 8.6 (High).

Operationally, ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-53452

Vulnerability Data

A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling…

when parsing a specific BEEP SOAP request. An attacker could exploit this vulnerability by sending a specific BEEP SOAP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.