EVENT DOSSIER
Cisco has released IOS XR security updates aimed at fixing three high-risk vulnerabilities. CVE-2026-20274 and CVE-2026-20279 both have a score of 9.8, involving buffer overflow and authentication deficiencies respectively; another vulnerability, CVE-2026-20212, due to improper integration of Silicon One processors, poses a risk of remote code execution for Nexus 9000 series switches. This vulnerability was discovered during an internal security review. Cisco recommends that users use Infrastructure Access Control Lists (iACLs) to restrict management traffic or deny TCP packets from specific ports to mitigate the risk. A permanent fix for CVE-2026-20212 has not been released yet, but auxiliary download tools are available. The company states that no related attacks have been observed, but warns that hackers may exploit AI to create malware.
Cisco 发布 IOS XR 更新以修复三个高危漏洞，其中 CVE-2026-20274 和 CVE-2026-20279 评分均为 9.8，涉及缓冲区溢出及认证缺失等问题；另一项 CVE-2026-20212 因与 Silicon One 处理器集成不当导致 Nexus 9000 系列交换机存在远程代码执行风险。Cisco 称漏洞源于内部安全审查，建议用户通过基础设施访问控制列表（iACLs）限制管理流量或明确拒绝特定端口 TCP 包进行缓解，目前尚未发布针对 CVE-2026-20212 的永久修复补丁，但已提供辅助下载工具；公司表示尚未观察到相关攻击，但警告黑客可能利用 AI 生成恶意软件。