{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20046", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.354Z", "datePublished": "2026-03-11T16:31:18.318Z", "dateUpdated": "2026-03-12T03:55:36.546Z"}, "containers": {"cna": {"title": "Cisco IOS XR Software CLI Privilege Escalation Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device.\r\n\r\nThis vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W", "name": "cisco-sa-iosxr-privesc-bF8D5U4W"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-iosxr-privesc-bF8D5U4W", "discovery": "INTERNAL", "defects": ["CSCwp87543"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Permissions, Privileges, and Access Control", "type": "cwe", "cweId": "CWE-264"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XR Software", "versions": [{"version": "6.6.1", "status": "affected"}, {"version": "6.5.3", "status": "affected"}, {"version": "7.0.1", "status": "affected"}, {"version": "6.5.1", "status": "affected"}, {"version": "6.5.2", "status": "affected"}, {"version": "6.6.2", "status": "affected"}, {"version": "6.6.25", "status": "affected"}, {"version": "7.1.1", "status": "affected"}, {"version": "7.0.90", "status": "affected"}, {"version": "6.6.3", "status": "affected"}, {"version": "7.0.2", "status": "affected"}, {"version": "7.1.2", "status": "affected"}, {"version": "7.2.1", "status": "affected"}, {"version": "6.6.4", "status": "affected"}, {"version": "7.3.1", "status": "affected"}, {"version": "7.4.1", "status": "affected"}, {"version": "7.2.2", "status": "affected"}, {"version": "7.3.2", "status": "affected"}, {"version": "7.5.1", "status": "affected"}, {"version": "7.6.1", "status": "affected"}, {"version": "7.5.2", "status": "affected"}, {"version": "7.3.4", "status": "affected"}, {"version": "7.3.3", "status": "affected"}, {"version": "7.4.2", "status": "affected"}, {"version": "7.7.1", "status": "affected"}, {"version": "7.6.2", "status": "affected"}, {"version": "7.8.1", "status": "affected"}, {"version": "7.7.2", "status": "affected"}, {"version": "7.9.1", "status": "affected"}, {"version": "7.8.2", "status": "affected"}, {"version": "7.5.4", "status": "affected"}, {"version": "7.8.22", "status": "affected"}, {"version": "7.10.1", "status": "affected"}, {"version": "7.7.21", "status": "affected"}, {"version": "7.9.2", "status": "affected"}, {"version": "7.5.5", "status": "affected"}, {"version": "7.11.1", "status": "affected"}, {"version": "7.10.2", "status": "affected"}, {"version": "7.3.6", "status": "affected"}, {"version": "24.1.1", "status": "affected"}, {"version": "7.11.2", "status": "affected"}, {"version": "24.2.1", "status": "affected"}, {"version": "24.1.2", "status": "affected"}, {"version": "24.3.1", "status": "affected"}, {"version": "24.4.1", "status": "affected"}, {"version": "24.2.2", "status": "affected"}, {"version": "7.11.21", "status": "affected"}, {"version": "24.2.20", "status": "affected"}, {"version": "24.3.2", "status": "affected"}, {"version": "24.4.2", "status": "affected"}, {"version": "25.1.1", "status": "affected"}, {"version": "24.3.20", "status": "affected"}, {"version": "25.2.1", "status": "affected"}, {"version": "25.1.2", "status": "affected"}, {"version": "24.3.30", "status": "affected"}, {"version": "24.2.21", "status": "affected"}, {"version": "25.1.30", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-11T16:31:18.318Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-20046"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T03:55:36.546Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20046", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T17:03:43.322668Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T17:14:22.897Z"}}], "cna": {"title": "Cisco IOS XR Software CLI Privilege Escalation Vulnerability", "source": {"defects": ["CSCwp87543"], "advisory": "cisco-sa-iosxr-privesc-bF8D5U4W", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XR Software", "versions": [{"status": "affected", "version": "6.6.1"}, {"status": "affected", "version": "6.5.3"}, {"status": "affected", "version": "7.0.1"}, {"status": "affected", "version": "6.5.1"}, {"status": "affected", "version": "6.5.2"}, {"status": "affected", "version": "6.6.2"}, {"status": "affected", "version": "6.6.25"}, {"status": "affected", "version": "7.1.1"}, {"status": "affected", "version": "7.0.90"}, {"status": "affected", "version": "6.6.3"}, {"status": "affected", "version": "7.0.2"}, {"status": "affected", "version": "7.1.2"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "6.6.4"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "7.3.2"}, {"status": "affected", "version": "7.5.1"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.5.2"}, {"status": "affected", "version": "7.3.4"}, {"status": "affected", "version": "7.3.3"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.7.1"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.8.1"}, {"status": "affected", "version": "7.7.2"}, {"status": "affected", "version": "7.9.1"}, {"status": "affected", "version": "7.8.2"}, {"status": "affected", "version": "7.5.4"}, {"status": "affected", "version": "7.8.22"}, {"status": "affected", "version": "7.10.1"}, {"status": "affected", "version": "7.7.21"}, {"status": "affected", "version": "7.9.2"}, {"status": "affected", "version": "7.5.5"}, {"status": "affected", "version": "7.11.1"}, {"status": "affected", "version": "7.10.2"}, {"status": "affected", "version": "7.3.6"}, {"status": "affected", "version": "24.1.1"}, {"status": "affected", "version": "7.11.2"}, {"status": "affected", "version": "24.2.1"}, {"status": "affected", "version": "24.1.2"}, {"status": "affected", "version": "24.3.1"}, {"status": "affected", "version": "24.4.1"}, {"status": "affected", "version": "24.2.2"}, {"status": "affected", "version": "7.11.21"}, {"status": "affected", "version": "24.2.20"}, {"status": "affected", "version": "24.3.2"}, {"status": "affected", "version": "24.4.2"}, {"status": "affected", "version": "25.1.1"}, {"status": "affected", "version": "24.3.20"}, {"status": "affected", "version": "25.2.1"}, {"status": "affected", "version": "25.1.2"}, {"status": "affected", "version": "24.3.30"}, {"status": "affected", "version": "24.2.21"}, {"status": "affected", "version": "25.1.30"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W", "name": "cisco-sa-iosxr-privesc-bF8D5U4W"}], "descriptions": [{"lang": "en", "value": "A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device.\r\n\r\nThis vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-264", "description": "Permissions, Privileges, and Access Control"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-11T16:31:18.318Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20046", "state": "PUBLISHED", "dateUpdated": "2026-03-12T03:55:36.546Z", "dateReserved": "2025-10-08T11:59:15.354Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-03-11T16:31:18.318Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device.\r\n\r\nThis vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks."}], "id": "CVE-2026-20046", "lastModified": "2026-03-12T21:08:22.643", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "[email protected]", "type": "Primary"}]}, "published": "2026-03-11T17:16:55.230", "references": [{"source": "[email protected]", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "[email protected]", "type": "Primary"}]}

{}