Cisco IOS XR (ASR 9000/9900 Series): crafted IPv4 packets can reset or shut down line card network processors, causing DoS (CVE-2026-76505)
Severity: high · Patch status: patched · Since 2026-10-21 · CVE-2026-76505
Cisco published a High-severity advisory (CVE-2026-76505, CWE-20, CVSS 7.5) for a denial-of-service vulnerability in the IPv4 packet-processing path of IOS XR on ASR 9000 and 9900 Series routers with Lightspeed- or Lightspeed-Plus-based line cards, and on ASR 9902/9903 compact routers. An unauthenticated remote attacker can send crafted IPv4 packets processed as for-us traffic to trigger network processor resets; repeated resets can leave the NP in a persistent shutdown state requiring a line card reload. Transit IPv4 and IPv6 traffic do not trigger it; IPv6-only configurations are unaffected. Cisco has released fixed software; no workarounds exist, but an iACL dropping UDP port 1701 traffic destined to infrastructure addresses is a proven mitigation. No exploitation reported in the wild.
What to do
- Upgrade ASR 9000/9900, ASR 9902/9903 routers running vulnerable IOS XR releases to a fixed release from the advisory
- Until patched, deploy an ingress iACL on edge/external interfaces denying UDP destination port 1701 to local router addresses while permitting transit traffic
- Inventory affected devices with show platform and confirm Lightspeed/Lightspeed-Plus line cards and IPv4-enabled interfaces via show ipv4 vrf all interface brief
- Check logs with show logging | include "NP.*reset" for signs of exploitation or prior NP resets
- Restrict exposure of router infrastructure addresses at the network edge generally
Sources
All live incidents on Threat Watch
