About:
CVE-2026-20188 is a denial of service vulnerability affecting Cisco Network Services Orchestrator (NSO) caused by insufficient rate limiting of incoming connections.
An unauthenticated remote attacker can exploit this vulnerability by sending crafted or excessive traffic to affected systems. Successful exploitation may cause orchestration services to become unresponsive, potentially requiring manual recovery or restart procedures to restore operations.
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
VULNERABILITIES
Denial of Service Vulnerability in Cisco Network Services Orchestrator
Identifier: CVE-2026-20188
CVSS Score: 7.5 (High, CVSS 3.1)
PoC or Exploitation:
There were no confirmed reports of active exploitation in the wild and no validated public proof-of-concept exploit code.
Update/ Patch:
Cisco has released security updates for affected products.
Affected versions include:
Cisco CNC Release7.1 and earlier
Cisco NSO Release6.3 and earlier6.4 prior to 6.4.1.3
Fixed versions include:
Cisco CNC ReleaseMigrate to a fixed release
Cisco NSO Release6.4.1.36.5 (not vulnerable)
Cisco advisory and patch guidance:
Description:
CVE-2026-20188 is a denial of service vulnerability affecting Cisco Network Services Orchestrator (NSO).
The vulnerability is caused by insufficient rate limiting of incoming connections. An unauthenticated remote attacker can exploit the issue by sending crafted or excessive traffic to the affected system.
Successful exploitation may cause the affected service to become unresponsive, potentially requiring manual intervention or restart procedures to restore normal operations.
Mitigation Recommendation:
Immediately apply Cisco security updates and fixed software releases.
Restrict access to Cisco NSO management interfaces to trusted administrative networks only.
Monitor systems for abnormal spikes in connection attempts, service instability, or unexpected outages.
Implement network segmentation and rate limiting controls where operationally feasible.
Conduct operational review of exposed orchestration systems to minimize unnecessary internet exposure.