Description
A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to improper handling when parsing a specific BEEP SOAP request. An attacker could exploit this vulnerability by sending a specific BEEP SOAP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
Published: 2026-08-05
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in Cisco IOS XE Software’s Blocks Extensible Exchange Protocol (BEEP) handling of SOAP requests. An unauthenticated, remote attacker can send a specially crafted BEEP SOAP message that the device parses improperly, which can trigger an unexpected reload of the system. The result is a denial of service that disrupts network services without requiring any credentials. The weakness is a lack of input validation during SOAP parsing, identified by CWE-388.

Affected Systems

Affected systems are Cisco IOS XE Software deployments. Version details are not specified in the advisory; affected releases include any IOS XE image that implements the BEEP feature and has not yet applied the vendor‑issued update. Administrators should consult the Cisco security advisory for precise version guidance.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no verified exploitation at this time. Attack vectors are remote over the network via the BEEP SOAP interface, and the flaw allows the attacker to cause a device reload without any authentication or special privileges. The potential impact remains a service interruption for the affected device.

Generated by OpenCVE AI on August 5, 2026 at 18:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Cisco IOS XE software update that fixes the BEEP SOAP parsing issue.
  • If possible, disable BEEP or block its traffic on untrusted interfaces to reduce exposure.
  • Monitor device logs for unexpected reload events or BEEP-related errors and investigate any suspicious activity promptly.

Generated by OpenCVE AI on August 5, 2026 at 18:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Description A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling when parsing a specific BEEP SOAP request. An attacker could exploit this vulnerability by sending a specific BEEP SOAP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
Title Cisco IOS XE Software Blocks Extensible Exchange Protocol Denial of Service Vulnerability
Weaknesses CWE-388
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-08-05T17:45:15.473Z

Reserved: 2025-10-08T11:59:15.402Z

Link: CVE-2026-20263

cve-icon Vulnrichment

Updated: 2026-08-05T17:39:26.566Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T19:00:05Z

Weaknesses