轉發 台灣電腦網路危機處理暨協調中心 資安訊息警訊 TWCERTCC-200-202609-00000004

[內容說明]
Cisco IOS XR Software開發團隊於內部安全審查期間發現多項安全漏洞，並已完成修補。目前尚未發現有證據顯示這些漏洞遭到積極利用。為協助客戶及時部署安全更新並簡化漏洞揭露流程，Cisco已公開相關漏洞資訊及修補建議。
CVE-2026-20280(CVSS：8.8)，為對異常情況檢查或處理不當。
CVE-2026-20279(CVSS：9.8)，為存取控制不當漏洞。
CVE-2026-20278(CVSS：8.8)，為不適當處理漏洞。
CVE-2026-20275(CVSS：8.8)，為計算錯誤，包含緩衝區大小計算錯誤、整數溢位等。
CVE-2026-20274(CVSS：9.8)，在資源的生命週期內對其進行不當控制。

[影響平台]
詳細受影響產品清單與版本，請參閱官方網站公告。

[建議措施]
根據官方網站釋出的解決方式進行修補。

[參考資料]
1. https://www.twcert.org.tw/tw/cp-169-11186-faaa9-1.html

Forwarded from Taiwan Computer Emergency Response Coordination Center Cybersecurity Information Alert TWCERTCC-200-202609-00000004

[Content Description]
The Cisco IOS XR Software development team discovered multiple security vulnerabilities during an internal security review and has completed the fixes. There is currently no evidence that these vulnerabilities have been actively exploited. To help customers deploy security updates in a timely manner and simplify the vulnerability disclosure process, Cisco has publicly disclosed the relevant vulnerability information and remediation recommendations.
CVE-2026-20280(CVSS：8.8), is an improper check or handling of exceptional conditions.
CVE-2026-20279(CVSS：9.8), is an improper access control vulnerability.
CVE-2026-20278(CVSS：8.8), is an improper handling vulnerability.
CVE-2026-20275(CVSS：8.8), is an incorrect calculation, including incorrect calculation of buffer sizes, integer overflow, etc.
CVE-2026-20274(CVSS：9.8), is improper control of a resource throughout its lifecycle.

[Affected Platforms]
For the detailed list of affected products and versions, please refer to the official website announcement.

[Recommended Measures]
Please apply the fixes according to the solutions released on the official website.

[References]
1. https://www.twcert.org.tw/tw/cp-169-11186-faaa9-1.html