Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).
- Vendor
- Cisco
- Product
- IOS XR
- CVSS
- 5.9
- EPSS (exploit probability)
- 3.3%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Added to KEV
Is CVE-2009-2055 being exploited?
Yes. CISA added CVE-2009-2055 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 3.3% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2009-2055 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
CISA required actionApply updates per vendor instructions.
US federal civilian agencies must remediate by (21 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Other Cisco IOS XR CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2022-20821 Cisco IOS XR Open Port Vulnerability | [ MEDIUM ] | 6.5 | 11.5% | |
| CVE-2010-3035 Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability | [ HIGH ] | 7.5 | 5.7% | |
| CVE-2020-3569 Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | [ HIGH ] | 8.6 | 3.3% | |
| CVE-2020-3566 Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | [ HIGH ] | 8.6 | 3.7% | |
| CVE-2020-3118 Cisco IOS XR Software Discovery Protocol Format String Vulnerability | [ HIGH ] | 8.8 | 11.7% |