{"id":"CVE-2026-20046","state":"PUBLISHED","title":"Cisco IOS XR Software CLI Privilege Escalation Vulnerability","description":"A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device.\r\n\r\nThis vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks.","publishedAt":"2026-03-11T16:31:18.318Z","updatedAt":"2026-03-12T03:55:36.546Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"cisco"},"assigner":"cisco","products":["Cisco Cisco IOS XR Software"],"affected":[{"vendor":"Cisco","product":"Cisco IOS XR Software","defaultStatus":"unknown","versions":[{"version":"6.6.1","status":"affected"},{"version":"6.5.3","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"6.5.1","status":"affected"},{"version":"6.5.2","status":"affected"},{"version":"6.6.2","status":"affected"},{"version":"6.6.25","status":"affected"},{"version":"7.1.1","status":"affected"},{"version":"7.0.90","status":"affected"},{"version":"6.6.3","status":"affected"},{"version":"7.0.2","status":"affected"},{"version":"7.1.2","status":"affected"},{"version":"7.2.1","status":"affected"},{"version":"6.6.4","status":"affected"},{"version":"7.3.1","status":"affected"},{"version":"7.4.1","status":"affected"},{"version":"7.2.2","status":"affected"},{"version":"7.3.2","status":"affected"},{"version":"7.5.1","status":"affected"},{"version":"7.6.1","status":"affected"},{"version":"7.5.2","status":"affected"},{"version":"7.3.4","status":"affected"},{"version":"7.3.3","status":"affected"},{"version":"7.4.2","status":"affected"},{"version":"7.7.1","status":"affected"},{"version":"7.6.2","status":"affected"},{"version":"7.8.1","status":"affected"},{"version":"7.7.2","status":"affected"},{"version":"7.9.1","status":"affected"},{"version":"7.8.2","status":"affected"},{"version":"7.5.4","status":"affected"},{"version":"7.8.22","status":"affected"},{"version":"7.10.1","status":"affected"},{"version":"7.7.21","status":"affected"},{"version":"7.9.2","status":"affected"},{"version":"7.5.5","status":"affected"},{"version":"7.11.1","status":"affected"},{"version":"7.10.2","status":"affected"},{"version":"7.3.6","status":"affected"},{"version":"24.1.1","status":"affected"},{"version":"7.11.2","status":"affected"},{"version":"24.2.1","status":"affected"},{"version":"24.1.2","status":"affected"},{"version":"24.3.1","status":"affected"},{"version":"24.4.1","status":"affected"},{"version":"24.2.2","status":"affected"},{"version":"7.11.21","status":"affected"},{"version":"24.2.20","status":"affected"},{"version":"24.3.2","status":"affected"},{"version":"24.4.2","status":"affected"},{"version":"25.1.1","status":"affected"},{"version":"24.3.20","status":"affected"},{"version":"25.2.1","status":"affected"},{"version":"25.1.2","status":"affected"},{"version":"24.3.30","status":"affected"},{"version":"24.2.21","status":"affected"},{"version":"25.1.30","status":"affected"}]}],"references":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W"],"weaknesses":["CWE-264"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/20xxx/CVE-2026-20046.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-20046","state":"PUBLISHED","datePublished":"2026-03-11T16:31:18.318Z","dateUpdated":"2026-03-12T03:55:36.546Z","assignerShortName":"cisco","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateReserved":"2025-10-08T11:59:15.354Z"},"containers":{"cna":{"title":"Cisco IOS XR Software CLI Privilege Escalation Vulnerability","descriptions":[{"lang":"en","value":"A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device.\r\n\r\nThis vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks."}],"affected":[{"vendor":"Cisco","product":"Cisco IOS XR Software","defaultStatus":"unknown","versions":[{"version":"6.6.1","status":"affected"},{"version":"6.5.3","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"6.5.1","status":"affected"},{"version":"6.5.2","status":"affected"},{"version":"6.6.2","status":"affected"},{"version":"6.6.25","status":"affected"},{"version":"7.1.1","status":"affected"},{"version":"7.0.90","status":"affected"},{"version":"6.6.3","status":"affected"},{"version":"7.0.2","status":"affected"},{"version":"7.1.2","status":"affected"},{"version":"7.2.1","status":"affected"},{"version":"6.6.4","status":"affected"},{"version":"7.3.1","status":"affected"},{"version":"7.4.1","status":"affected"},{"version":"7.2.2","status":"affected"},{"version":"7.3.2","status":"affected"},{"version":"7.5.1","status":"affected"},{"version":"7.6.1","status":"affected"},{"version":"7.5.2","status":"affected"},{"version":"7.3.4","status":"affected"},{"version":"7.3.3","status":"affected"},{"version":"7.4.2","status":"affected"},{"version":"7.7.1","status":"affected"},{"version":"7.6.2","status":"affected"},{"version":"7.8.1","status":"affected"},{"version":"7.7.2","status":"affected"},{"version":"7.9.1","status":"affected"},{"version":"7.8.2","status":"affected"},{"version":"7.5.4","status":"affected"},{"version":"7.8.22","status":"affected"},{"version":"7.10.1","status":"affected"},{"version":"7.7.21","status":"affected"},{"version":"7.9.2","status":"affected"},{"version":"7.5.5","status":"affected"},{"version":"7.11.1","status":"affected"},{"version":"7.10.2","status":"affected"},{"version":"7.3.6","status":"affected"},{"version":"24.1.1","status":"affected"},{"version":"7.11.2","status":"affected"},{"version":"24.2.1","status":"affected"},{"version":"24.1.2","status":"affected"},{"version":"24.3.1","status":"affected"},{"version":"24.4.1","status":"affected"},{"version":"24.2.2","status":"affected"},{"version":"7.11.21","status":"affected"},{"version":"24.2.20","status":"affected"},{"version":"24.3.2","status":"affected"},{"version":"24.4.2","status":"affected"},{"version":"25.1.1","status":"affected"},{"version":"24.3.20","status":"affected"},{"version":"25.2.1","status":"affected"},{"version":"25.1.2","status":"affected"},{"version":"24.3.30","status":"affected"},{"version":"24.2.21","status":"affected"},{"version":"25.1.30","status":"affected"}]}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W","name":"cisco-sa-iosxr-privesc-bF8D5U4W"}],"metrics":[{"format":"cvssV3_1","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-264","lang":"en","description":"Permissions, Privileges, and Access Control","type":"cwe"}]}],"providerMetadata":{"shortName":"cisco","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateUpdated":"2026-03-11T16:31:18.318Z"},"exploits":[{"lang":"en","value":"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}],"source":{"advisory":"cisco-sa-iosxr-privesc-bF8D5U4W","discovery":"INTERNAL","defects":["CSCwp87543"]}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-11T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-20046"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-12T03:55:36.546Z"}}]}}}