SHIFTWIRE
Log inGet Early Access
BACK TO THE WIRE
SW-000353CISCO · CISCO IOS XR SOFTWARE · ASR 9000, 9900 SERIES AGGREGATION SERVICES ROUTERS; ASR 9902, 9903 COMPACT HIGH-PERFORMANCE ROUTERS · IPV4 PACKET PROCESSINGHIGHACTION REQUIRED

Cisco IOS XR ASR 9000/9900/9902/9903 IPv4 flaw allows line card DoS via crafted packets

A vulnerability (CVE-2026-76505, CVSS 7.5) in the IPv4 packet-processing path of Cisco IOS XR 64-bit Software affects ASR 9000 and 9900 Series routers with Lightspeed or Lightspeed-Plus line cards, and ASR 9902/9903 Compact High-Performance Routers. An unauthenticated remote attacker can send crafted IPv4 for-us packets to cause network processor (NP) resets, leading to line card reset or, under repeated resets, a persistent shutdown requiring manual reload. Transit IPv4 and all IPv6 traffic are not affected. No workaround exists, but a mitigation (filtering UDP port 1701 to infrastructure addresses via iACL) is available; fixed software releases have been published.

NETWORK · SECURITY · SECURITY ADVISORY · VULNERABILITY

PUBLISHED OCT 23, 2026 19:47 UTC

WHAT CHANGED

Cisco disclosed CVE-2026-76505, a DoS vulnerability due to incorrect handling of crafted IPv4 packets processed as for-us traffic on affected line card interfaces of ASR 9000/9900 (with Lightspeed/Lightspeed-Plus line cards) and ASR 9902/9903 routers running vulnerable IOS XR 64-bit releases with IPv4 enabled on any interface. Cisco has released fixed software (e.g., 7.9.2, 7.10.2, 7.11.2, 24.1.2, 24.2.2, 24.3.2, 24.4.2 and associated SMUs) and states releases 25.1 and later are not affected. There are no workarounds, but an iACL-based mitigation filtering UDP destination port 1701 to infrastructure addresses is documented.

WHY IT MATTERS

An unauthenticated remote attacker could trigger repeated NP resets causing traffic loss and, in persistent shutdown scenarios, a line card outage requiring manual intervention on core/edge routing hardware. Administrators running affected ASR platforms with IPv4 enabled must identify installed Lightspeed/Lightspeed-Plus line cards, assess exposure, apply the iACL mitigation if feasible, and plan upgrades to fixed IOS XR releases to avoid denial-of-service impact on production network infrastructure.

WHO IS AFFECTED

ROLES
network administratorsecurity operations
PRODUCTS
Cisco IOS XR SoftwareCisco ASR 9000 Series Aggregation Services RoutersCisco ASR 9900 Series Aggregation Services RoutersCisco ASR 9902 Compact High-Performance RouterCisco ASR 9903 Compact High-Performance Router
FEATURES
IPv4 packet processingLightspeed-based line cardsLightspeed-Plus-based line cardsNetwork processor (NP)
CONFIGURATIONS
IPv4 enabled on any interface on an installed Lightspeed or Lightspeed-Plus line card64-bit Cisco IOS XR Software releases
ENVIRONMENTS
production network infrastructure
EXCLUSIONS
Cisco IOS SoftwareCisco IOS XE SoftwareCisco IOS XR platforms not listed in the Vulnerable Products sectionCisco NX-OS SoftwareIPv6-only configurationsTransit IPv4 traffic (does not trigger the vulnerability)

WHAT TO DO

  1. 01
    CRITICAL

    Upgrade affected ASR 9000/9900/9902/9903 devices running vulnerable Cisco IOS XR 64-bit releases to the first fixed release or applicable SMU identified in the advisory's Fixed Releases table (e.g., 7.9.2, 7.10.2, 7.11.2, 24.1.2, 24.2.2, 24.3.2, 24.4.2, or 25.1 and later).

    DOCUMENTATION
  2. 02
    HIGHAUTOMATABLE

    Deploy an ingress infrastructure ACL (iACL) on edge/external interfaces to drop UDP destination port 1701 traffic destined to router interface/loopback addresses while continuing to permit transit traffic, as a temporary mitigation until upgrade.

    DOCUMENTATION
  3. 03
    HIGHAUTOMATABLE

    Run 'show platform' to identify which line cards are installed and determine if any are Lightspeed- or Lightspeed-Plus-based (or confirm ASR 9902/9903 chassis, which integrate Lightspeed-Plus cards by default).

    DOCUMENTATION
  4. 04
    MEDIUMAUTOMATABLE

    Run 'show ipv4 vrf all interface brief' to determine whether IPv4 addressing is configured on any interface of a vulnerable line card.

    DOCUMENTATION
  5. 05
    MEDIUMAUTOMATABLE

    Run 'show logging | include "NP.*reset"' to check for evidence of network processor resets potentially caused by this vulnerability and engage the appropriate support organization to confirm results.

    DOCUMENTATION
  6. 06
    MEDIUM

    Contact Cisco TAC to obtain SMUs for platforms or releases not directly listed in the Fixed Releases table.

    DOCUMENTATION

TIMELINE

ANNOUNCED
OCT 21, 2026

SOURCES

  • PRIMARY SOURCECISCO

    Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability

    PUBLISHED OCT 21, 2026VIEW SOURCE

VERIFICATION

HUMAN VERIFIEDLAST VERIFIED OCT 23, 2026 19:47 UTCREVISION 2

ShiftWire summarizes and analyzes changes from the cited sources. Always review the primary source before implementing material changes.

WAS THIS USEFUL?