{"api_version":"1","generated_at":"2026-07-13T22:50:47+00:00","cve":"CVE-2026-20046","urls":{"html":"https://cve.report/CVE-2026-20046","api":"https://cve.report/api/cve/CVE-2026-20046.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-20046","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-20046"},"summary":{"title":"Cisco IOS XR Software CLI Privilege Escalation Vulnerability","description":"A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device.\r\n\r\nThis vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks.","state":"PUBLISHED","assigner":"cisco","published_at":"2026-03-11 17:16:55","updated_at":"2026-07-01 17:10:13"},"problem_types":["CWE-264","CWE-264 Permissions, Privileges, and Access Control"],"metrics":[{"version":"3.1","source":"psirt@cisco.com","type":"Secondary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSSV3_1","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W","name":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W","refsource":"psirt@cisco.com","tags":["Mitigation","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-20046","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20046","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 6.6.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 6.5.3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.0.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 6.5.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 6.5.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 6.6.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 6.6.25","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.1.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.0.90","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 6.6.3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.0.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.1.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.2.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 6.6.4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.3.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.4.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.2.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.3.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.5.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.6.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.5.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.3.4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.3.3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.4.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.7.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.6.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.8.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.7.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.9.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.8.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.5.4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.8.22","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.10.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.7.21","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.9.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.5.5","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.11.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.10.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.3.6","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 24.1.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.11.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 24.2.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 24.1.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 24.3.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 24.4.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 24.2.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 7.11.21","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 24.2.20","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 24.3.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 24.4.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 25.1.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 24.3.20","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 25.2.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 25.1.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 24.3.30","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 24.2.21","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco IOS XR Software","version":"affected 25.1.30","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[{"source":"CNA","title":"","value":"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.","time":"","lang":"en"}],"credits":[],"nvd_cpes":[{"cve_year":"2026","cve_id":"20046","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"cisco","cpe5":"ios_xr","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"20046","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"cisco","cpe5":"ios_xrv_9000","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"20046","cve":"CVE-2026-20046","epss":"0.001350000","percentile":"0.033060000","score_date":"2026-07-04","updated_at":"2026-07-05 00:02:27"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-20046","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-03-11T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-03-12T03:55:36.546Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","product":"Cisco IOS XR Software","vendor":"Cisco","versions":[{"status":"affected","version":"6.6.1"},{"status":"affected","version":"6.5.3"},{"status":"affected","version":"7.0.1"},{"status":"affected","version":"6.5.1"},{"status":"affected","version":"6.5.2"},{"status":"affected","version":"6.6.2"},{"status":"affected","version":"6.6.25"},{"status":"affected","version":"7.1.1"},{"status":"affected","version":"7.0.90"},{"status":"affected","version":"6.6.3"},{"status":"affected","version":"7.0.2"},{"status":"affected","version":"7.1.2"},{"status":"affected","version":"7.2.1"},{"status":"affected","version":"6.6.4"},{"status":"affected","version":"7.3.1"},{"status":"affected","version":"7.4.1"},{"status":"affected","version":"7.2.2"},{"status":"affected","version":"7.3.2"},{"status":"affected","version":"7.5.1"},{"status":"affected","version":"7.6.1"},{"status":"affected","version":"7.5.2"},{"status":"affected","version":"7.3.4"},{"status":"affected","version":"7.3.3"},{"status":"affected","version":"7.4.2"},{"status":"affected","version":"7.7.1"},{"status":"affected","version":"7.6.2"},{"status":"affected","version":"7.8.1"},{"status":"affected","version":"7.7.2"},{"status":"affected","version":"7.9.1"},{"status":"affected","version":"7.8.2"},{"status":"affected","version":"7.5.4"},{"status":"affected","version":"7.8.22"},{"status":"affected","version":"7.10.1"},{"status":"affected","version":"7.7.21"},{"status":"affected","version":"7.9.2"},{"status":"affected","version":"7.5.5"},{"status":"affected","version":"7.11.1"},{"status":"affected","version":"7.10.2"},{"status":"affected","version":"7.3.6"},{"status":"affected","version":"24.1.1"},{"status":"affected","version":"7.11.2"},{"status":"affected","version":"24.2.1"},{"status":"affected","version":"24.1.2"},{"status":"affected","version":"24.3.1"},{"status":"affected","version":"24.4.1"},{"status":"affected","version":"24.2.2"},{"status":"affected","version":"7.11.21"},{"status":"affected","version":"24.2.20"},{"status":"affected","version":"24.3.2"},{"status":"affected","version":"24.4.2"},{"status":"affected","version":"25.1.1"},{"status":"affected","version":"24.3.20"},{"status":"affected","version":"25.2.1"},{"status":"affected","version":"25.1.2"},{"status":"affected","version":"24.3.30"},{"status":"affected","version":"24.2.21"},{"status":"affected","version":"25.1.30"}]}],"descriptions":[{"lang":"en","value":"A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device.\r\n\r\nThis vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks."}],"exploits":[{"lang":"en","value":"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"cvssV3_1"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-264","description":"Permissions, Privileges, and Access Control","lang":"en","type":"cwe"}]}],"providerMetadata":{"dateUpdated":"2026-03-11T16:31:18.318Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"cisco-sa-iosxr-privesc-bF8D5U4W","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W"}],"source":{"advisory":"cisco-sa-iosxr-privesc-bF8D5U4W","defects":["CSCwp87543"],"discovery":"INTERNAL"},"title":"Cisco IOS XR Software CLI Privilege Escalation Vulnerability"}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2026-20046","datePublished":"2026-03-11T16:31:18.318Z","dateReserved":"2025-10-08T11:59:15.354Z","dateUpdated":"2026-03-12T03:55:36.546Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-03-11 17:16:55","lastModifiedDate":"2026-07-01 17:10:13","problem_types":["CWE-264","CWE-264 Permissions, Privileges, and Access Control"],"metrics":{"cvssMetricV31":[{"source":"psirt@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2,"impactScore":6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-11T00:00:00+00:00","id":"CVE-2026-20046","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*","versionEndExcluding":"25.2.2","matchCriteriaId":"D5A5E154-0631-4AEC-8675-7257BABF5086"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:cisco:ios_xrv_9000:-:*:*:*:*:*:*:*","matchCriteriaId":"EEE98C3E-67E2-43A3-AEA9-1575F2B93A78"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"20046","Ordinal":"1","Title":"Cisco IOS XR Software CLI Privilege Escalation Vulnerability","CVE":"CVE-2026-20046","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"20046","Ordinal":"1","NoteData":"A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device.\r\n\r\nThis vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks.","Type":"Description","Title":"Cisco IOS XR Software CLI Privilege Escalation Vulnerability"}]}}}