CVE-2026-20086

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of a malformed CAPWAP packet. An attacker could exploit this vulnerability by sending a malformed CAPWAP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-230

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Mar 25, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-200874.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileCVE-2026-200884.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileCVE-2026-200894.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileCVE-2026-20096.5A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/phCVE-2026-200904.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileCVE-2026-200914.8A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, reCVE-2026-200926.0A vulnerability in the read-only maintenance shell of Cisco Intersight Virtual Appliance could allow an authenticated, local attacker with aCVE-2026-200939.8A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote CVE-2026-200948.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with read-only privileges tCVE-2026-200956.5A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privilegesCVE-2026-200966.5A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privilegesCVE-2026-200976.5A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges
CVE-2026-20086: High severity, CVSS 8.6 | Vulnix