Summary

• A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device.

  This vulnerability exists because incorrect privileges are associated with the start maintenance command. An attacker could exploit this vulnerability by accessing the management CLI of the affected device as a low-privileged user and using the start maintenance command. A successful exploit could allow the attacker to put the device in maintenance mode, which shuts down interfaces, resulting in a denial of service (DoS) condition. In case of exploitation, a device administrator can connect to the CLI and use the stop maintenance command to restore operations.

  Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-mntc-dos-LZweQcyq

  This advisory is part of the March 2026 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: March 2026 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication.

Affected Products

• Vulnerable Products

  At the time of publication, this vulnerability affected Cisco IOS XE Software if it supported the start maintenance command.

  For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.

  Determine Whether the start maintenance Command Is Supported

  To determine whether the start maintenance command is supported, enter the start maintenance command on the CLI. If the output indicates the command is not recognized, the device does not support the start maintenance command and is not affected by this vulnerability.

  Products Confirmed Not Vulnerable

  Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

  Cisco has confirmed that this vulnerability does not affect the following Cisco products:

  • IOS Software
  • IOS XR Software
  • NX-OS Software

Workarounds

• There is a workaround that addresses this vulnerability. Set the privilege level of the start maintenance command manually by connecting to the device management CLI and using the privilege exec level 15 start maintenance configuration command, as shown in the following example:

  Router# configuration terminal
  Enter configuration commands, one per line.  End with CNTL/Z.
  Router(config)# privilege exec level 15 start maintenance

  While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

Fixed Software

• Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.

  Cisco IOS and IOS XE Software

  To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker. This tool identifies any Cisco security advisories that impact a specific software release and the earliest release that fixes the vulnerabilities that are described in each advisory (“First Fixed”). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities that are described in all the advisories that the Software Checker identifies (“Combined First Fixed”).

  To use the tool, go to the Cisco Software Checker page and follow the instructions. Alternatively, use the following form to determine whether a release is affected by any Cisco Security Advisory. To use the form, follow these steps:

  1. Choose which advisories the tool will search-only this advisory, only advisories with a Critical or High Security Impact Rating (SIR), or all advisories.
  2. Enter a release number-for example, 15.9(3)M2 or 17.3.3.
  3. Click Check.

  
  

  Only this advisory All Critical and High advisories All advisories

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is aware that a public announcement is available for the vulnerability that is described in this advisory.

  The Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory.

Source

• Cisco would like to thank the Unit 515 team of OPSWAT for reporting this vulnerability.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-mntc-dos-LZweQcyq

Revision History

• Version	Description	Section	Status	Date
  1.1	Added check for vulnerable system.	Affected Products	Final	2026-APR-02
  1.0	Initial public release.	-	Final	2026-MAR-25

  Show Less