CVE-2026-20113: Cisco IOS XE Software

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a carriage return line feed (CRLF) injection attack against a user. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by sending crafted packets to an affected device. A successful exploit could allow the attacker to arbitrarily inject log entries, manipulate the structure of log files, or obscure legitimate log events.

Affected products

• Cisco Cisco IOS XE Software: version 16.6.1 only; version 16.6.2 only; version 16.6.3 only; version 16.6.4 only; version 16.6.5 only; version 16.6.4a only; …

Published 2026-03-25. Last modified 2026-06-17.