Summary

• A vulnerability in the handling of an Egress Packet Network Interface (EPNI) Aligner interrupt in Cisco IOS XR Software for Cisco Network Convergence System (NCS) 5500 Series with NC57 line cards and Cisco NCS 5700 Routers and Cisco IOS XR Software for Third Party Software could allow an unauthenticated, remote attacker to cause the network processing unit (NPU) and ASIC to stop processing, preventing traffic from traversing the interface.

  This vulnerability is due to the corruption of packets in specific cases when an EPNI Aligner interrupt is triggered while an affected device is experiencing heavy transit traffic. An attacker could exploit this vulnerability by sending a continuous flow of crafted packets to an interface of the affected device. A successful exploit could allow the attacker to cause persistent, heavy packet loss, resulting in a denial of service (DoS) condition.

  Note: If active exploitation of this vulnerability is suspected, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider.

  Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. This change was made because the affected device operates within a critical network segment where compromise could lead to significant disruption or exposure, thereby elevating the overall risk beyond the base technical severity.

  Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrncs-epni-int-dos-TWMffUsN

  This advisory is part of the March 2026 release of the Cisco IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: March 2026 Semiannual Cisco IOS XR Software Security Advisory Bundled Publication.

Affected Products

• Vulnerable Products

  This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco IOS XR Software, regardless of the device configuration:

  • NCS 5700 Series line cards with the following products IDs (PIDs):
    • NC57-18DD-SE
    • NC57-24DD
    • NC57-36H-SE
    • NC57-36H6D-S
    • NC57-MOD-S
  • NCS 5700 Series Fixed Chassis with the following PIDs:
    • NCS-57B1-5D24H-SE
    • NCS-57B1-5DSE-SYS
    • NCS-57B1-6D24-SYS
    • NCS-57B1-6D24H-S

  This vulnerability also affects Cisco IOS XR for Third Party Hardware if the third-party hardware has a Jericho 2 ASIC.

  For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.

  Determine Whether an Affected Line Card Is Installed

  To determine if an affected line card is installed on a system, use the show inventory CLI command and look for the PIDs of affected line cards:

  RP/0/RP0/CPU0:NCS_Router# show inventory
  Tue Feb 18 10:55:15.397 UTC
  NAME: "0/0", DESCR: "NCS 5700 18x400GE Line Card with TCAM"
  PID: NC57-18DD-SE      , VID: V03, SN: JAE271602RT
  
  NAME: "HundredGigE0/0/0/0", DESCR: "Cisco QSFP28 100G SR4 Pluggable Optics Module"
  PID: QSFP-100G-SR4-S   , VID: V03, SN: INL270701RY
  
  NAME: "FourHundredGigE0/0/0/18", DESCR: "Cisco QSFPDD 400G DR4 Pluggable Optics Module"
  PID: QDD-400G-DR4-S    , VID: V02 , SN: INL27060SZ7
  
  NAME: "0/1", DESCR: "NCS 5700 36x100GE 6x400GE Line Card"
  PID: NC57-36H6D-S      , VID: V01, SN: JAE27170FQG
  
  NAME: "0/2", DESCR: "NCS 5700 2XMPA Scaled Line Card, MACSec"
  PID: NC55-MOD-A-SE-S   , VID: V02, SN: JAE2714041Y
  
  NAME: "GigabitEthernet0/2/0/4", DESCR: "Cisco SFP 1G 1000BASE-SX Pluggable Optics Module"
  PID: SFP-GE-S          , VID: V01, SN: FNS11510HSN
  
  NAME: "0/3", DESCR: "NCS 5700 36x100GE Line Card with TCAM"
  PID: NC57-36H-SE       , VID: V02, SN: JAE271406WC

  
  

  Products Confirmed Not Vulnerable

  Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

  Cisco has confirmed that this vulnerability does not affect the following Cisco products:

  • IOS Software
  • IOS XE Software
  • IOS XR Software that is running on devices other than the models listed in the Vulnerable Products section of this advisory
  • NX-OS Software

Details

• An EPNI Aligner interrupt on a device may be evidence of an attempted attack using this vulnerability. To check for interrupts, use the show asic-errors fia all location "" | begin Aligner command.

  RP/0/RP0/CPU0:NCS_Router# show asic-errors fia all location 0/4/CPU0 | begin Aligner
  
  Name : EPNI_0.Interrupt_Register.AlignerTransmitSizeAboveThInt
  Leaf ID : 0x36030011
  Error count : 2
  Last clearing : DDD MMM X HH:MM:SS YYYY
  Last N errors : 2
  --------------------------------------------------------------
  First N errors.
  @Time, Error-Data
  ------------------------------------------
  
  Error description: Check for misconfiguration in ETPP|None
  
  Error description: Check for misconfiguration in ETPP|None

  If the output of this command includes AlignerTransmitSizeAboveThInt in the Name field, an EPNI Aligner interrupt has occurred.

  However, devices that are running a fixed release of Cisco IOS XR Software or have an SMU installed to address this vulnerability will handle the interrupt gracefully and will not be affected by this vulnerability. If a device is running a vulnerable release of Cisco IOS XR Software, an EPNI Aligner interrupt could result in a DoS condition.

  Cisco strongly recommends that all customers who have affected PIDs in their networks install the appropriate SMU or upgrade to a fixed Cisco IOS XR Software release. See the Fixed Software section of this advisory for additional information.

Workarounds

• There are no workarounds that address this vulnerability.

Fixed Software

• Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.

  Fixed Releases

  In the following table, the left column lists Cisco software releases or trains. The right column indicates whether a release (train) is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability.

  Cisco IOS XR Software Releases	First Fixed Release
  7.8.2 and earlier	Not affected.
  7.9	Migrate to a fixed release or apply SMU.
  7.10	Migrate to a fixed release or apply SMU.
  7.11	Migrate to a fixed release or apply SMU.
  24.1	Migrate to a fixed release or apply SMU.
  24.2	Migrate to a fixed release or apply SMU.
  24.3	Migrate to a fixed release or apply SMU.
  24.4	Migrate to a fixed release or apply SMU.
  25.1	Migrate to a fixed release or apply SMU.
  25.2	Not vulnerable.
  25.3	Not vulnerable.
  25.4	Not vulnerable.
  26.1	Not vulnerable.

  The following SMUs have been made public to address this issue.

  Cisco IOS XR Software Release	Cisco Bug ID	SMU Name
  7.9.2	CSCws66900	ncs5500-7.9.2.CSCws66900 ncs5700-7.9.2.CSCws66900 iosxrwbd-7.9.2.CSCws66900
  7.10.2	CSCws66892	ncs5500-7.10.2.CSCws66892 ncs5700-7.10.2.CSCws66892
  7.11.2	CSCws66900	ncs5500-7.11.2.CSCws66900 ncs5700-7.11.2.CSCws66900 iosxrwbd-7.11.2.CSCws66900
  7.11.21	CSCws66900	ncs5500-7.11.21.CSCws66900 ncs5700-7.11.21.CSCws66900
  24.1.2	CSCws66892	ncs5500-24.1.2.CSCws66892 ncs5700-24.1.2.CSCws66892
  24.2.2	CSCws66892	ncs5500-24.2.2.CSCws66892 ncs5700-24.2.2.CSCws66892
  24.2.21	CSCws66900	ncs5500-24.2.21.CSCws66900 ncs5700-24.2.21.CSCws66900
  24.3.2	CSCws66900	ncs5500-24.3.2.CSCws66900 ncs5700-24.3.2.CSCws66900
  24.4.2	CSCws66900	ncs5500-24.4.2.CSCws66900 ncs5700-24.4.2.CSCws66900
  25.1.2	CSCws66900	ncs5500-25.1.2.CSCws66900 ncs5700-25.1.2.CSCws66900

  The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

• This vulnerability was found during the resolution of a Cisco Technical Assistance Center (TAC) support case.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrncs-epni-int-dos-TWMffUsN

Revision History

• Version	Description	Section	Status	Date
  1.0	Initial public release.	-	Final	2026-MAR-11

  Show Less