Cisco IOS XE Web-Based Management Interface Denial of Service Vulnerability

Cisco IOS XE Software Web-Based Management Interface Denial of Service Vulnerability Vulnerability Overview Vulnerability ID: cisco-sa-xe-webui-dos-PIA0DAWW CVE Number: CVE-2026-20311 CVSS Score: Base 8.3 Severity: Medium Release Date: August 5, 2026, 16:00 GMT Version: 1.0 Status: Final Description A vulnerability exists in the web-based management interface of Cisco IOS XE Software that allows an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to inadequate error handling in the web-based management interface. An attacker can exploit this vulnerability by using a malformed certificate for authentication. Successful exploitation may result in the affected device reloading, causing a DoS condition. Affected Products Affected Products: The vulnerability affects Cisco devices if the device is running a vulnerable version of Cisco IOS XE Software with the Personal Identity Verification (PIV) enabled HTTP server feature. The vulnerable state depends on the version and platform of the Cisco IOS XE Software. Determining HTTP Server Configuration: - To determine if the HTTP server feature is enabled for a device, log in to the device and check the CLI for the presence of the command or the command using the command. If either command is present, the HTTP server feature is enabled for the device. - If the command is present, and the configuration also includes , the vulnerability cannot be exploited via HTTP. - If the command is present, and the configuration also includes , the vulnerability cannot be exploited via HTTPS. Example Command Workarounds and Mitigations Fixed Software: Cisco considers any temporary workaround or mitigation (if applicable) to be a temporary solution before upgrading to a fixed software version. To fully resolve this vulnerability and avoid future exposure, Cisco strongly recommends that customers upgrade to the fixed software version indicated in this advisory. Cisco IOS and IOS XE Software: To assist customers in determining their exposure to this vulnerability in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker. This tool identifies the earliest version ("first fix") that impacts a specific software version and fixes the vulnerability described in this advisory. If applicable, the tool also returns the earliest version that fixes all vulnerabilities described in the advisory ("combo first fix"). Using the Tool 1. Select the advisories to search for—this advisory only, advisories with critical or high Security Investigation Rating (SIR) only, or all advisories. 2. Enter the version number—for example, 15.9(3)M2 or 17.3.3. 3. Click Check. Exploitation and Public Disclosures The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability described in this advisory. Credits Cisco thanks James for reporting this vulnerability. URL https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xe-webui-dos-PIA0DAWW Revision History

Goal Reached Thanks to every supporter — we hit 100%!

Cisco IOS XE Web-Based Management Interface Denial of Service Vulnerability