Key points
- CVE-2026-76505 affects ASR 9000, 9900, 9902, and 9903 routers running vulnerable IOS XR versions.
- The flaw allows unauthenticated remote attackers to trigger network processor resets and traffic loss.
- Cisco has released software updates to fix the issue, but no workarounds are available.
Crafted IPv4 packets can trigger a high-severity denial-of-service condition in specific Cisco routers. The malicious code targets the IPv4 packet processing functionality within Cisco IOS XR Software. Attackers do not need authentication to exploit this flaw. They send specially constructed packets to affected line card interfaces. The system processes these inputs as local traffic, causing network processor errors. This leads to line card resets or shutdowns, resulting in significant traffic loss for users relying on those interfaces.
Cisco confirmed that repeated reset conditions may force the network processor into a persistent shutdown state. In such cases, an explicit line card reload is required to restore normal operations. The vulnerability, tracked as CVE-2026-76505, carries a CVSS score of 7.5. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Transit IPv4 traffic and IPv6 traffic cannot trigger this issue.
What we know
The flaw exists in the IPv4 packet-processing path of Cisco IOS XR Software. It affects ASR 9000 and 9900 Series Aggregation Services Routers with Lightspeed or Lightspeed-Plus line cards. It also impacts ASR 9902 and 9903 Compact High-Performance Routers. Devices are vulnerable if they have IPv4 enabled on any interface. IPv6-only configurations are not affected. Cisco states that only the listed products are known to be affected by this specific vulnerability.
Defender's checklist
- Verify if your network uses ASR 9000, 9900, 9902, or 9903 series routers.
- Check installed line cards for Lightspeed or Lightspeed-Plus hardware types.
- Confirm if any interfaces have IPv4 addresses configured on vulnerable IOS XR versions.
- Review system logs for network processor resets that match the described error pattern.
What analysts watch for
Teams usually monitor for unexpected line card resets or sudden drops in throughput on specific interfaces. Analysts examine system logs for network processor errors that correlate with incoming IPv4 traffic spikes. They check whether the resets occur in patterns suggesting automated scanning or targeted attacks. Investigating the source IP addresses of the triggering packets helps determine if the activity is malicious or accidental. Persistence is not a factor here, as the impact is immediate service disruption rather than long-term access.
What to do and how to stay safe: Cisco
- Apply the latest Cisco IOS XR software updates to all affected routers immediately.
- Audit your network inventory to identify any devices running vulnerable software versions.
- Monitor line card status and system logs for signs of network processor resets.
- Contact Cisco support if you observe unexplained traffic loss or persistent shutdown states.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability affect IPv6 traffic?
No, IPv6 traffic cannot trigger this issue, and IPv6-only configurations are not affected.
Are there any workarounds for this flaw?
There are no workarounds that address this vulnerability; you must apply the software update.
Which Cisco routers are affected by CVE-2026-76505?
ASR 9000, 9900, 9902, and 9903 series routers with specific line cards are affected.
