CVE-2026-20275: Incorrect Calculation in Cisco Cisco IOS XR Software

Cisco IOS XR Software contains multiple internally discovered vulnerabilities related to incorrect calculation errors, tracked under CVE-2026-20275 and CWE-682. These issues were found during Cisco's internal security review and addressed through software hardening releases. The vulnerability impacts a wide range of specific versions of Cisco IOS XR Software, with a CVSS 3.1 base score of 8.8, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

The vulnerability allows an attacker to potentially compromise confidentiality, integrity, and availability of the affected Cisco IOS XR Software systems. Given the high CVSS score of 8.8, exploitation could lead to significant disruption or unauthorized access. However, there are no known exploits in the wild at this time.

Cisco has released software hardening updates addressing these vulnerabilities as part of their internal security review process. Users should apply the official patches or updates provided by Cisco for the affected versions. Since this is not a cloud service, remediation depends on deploying updated software versions. Patch status is not explicitly confirmed in the provided data; users should consult Cisco advisories for the latest remediation guidance.