Attack Chain

1. The attacker identifies a vulnerable Cisco Catalyst 9000 Series Switch running Cisco IOS XE with DHCP snooping enabled.
2. The attacker crafts a malicious BOOTP request packet. This packet can be either a unicast or broadcast BOOTP request.
3. The attacker sends the malicious BOOTP request packet to the targeted switch.
4. The vulnerable DHCP snooping feature improperly processes the BOOTP request.
5. Due to the improper handling, the switch forwards the BOOTP packet to an unintended VLAN.
6. This BOOTP VLAN leakage contributes to increased CPU utilization on the switch.
7. The high CPU utilization degrades the switch's performance, impacting its ability to forward network traffic.
8. The switch becomes unresponsive, leading to a denial-of-service condition, disrupting network services for connected devices.

Impact

Successful exploitation of CVE-2026-20084 leads to a denial-of-service condition on affected Cisco Catalyst 9000 Series Switches. This DoS can disrupt network services, causing connectivity issues for users and applications relying on the compromised switch. The high CPU utilization makes the device unreachable for management, complicating recovery efforts. While the exact number of potential victims is unknown, any organization using vulnerable Cisco Catalyst 9000 Series Switches is at risk. The network downtime caused by this vulnerability can lead to financial losses and reputational damage.

Recommendation

• Monitor network traffic for unusual BOOTP packet activity, specifically looking for packets being forwarded between VLANs, using a network intrusion detection system (IDS) and the network_connection log source.
• Deploy the Sigma rule provided to detect BOOTP packets being forwarded between VLANs, and tune the rule for your specific environment.
• Implement workarounds provided by Cisco to mitigate the vulnerability until a patch can be applied (reference the Cisco advisory for specific workaround details).