Cisco IOS XE Software on Cisco Catalyst 9500X and 9600X Series Switches Virtual Interface Access Control List Bypass Vulnerability

TL;DR 📌

A Medium severity vulnerability has been identified in Cisco IOS XE Software affecting Catalyst 9500X and 9600X Series Switches. An unauthenticated remote attacker could exploit this vulnerability to bypass configured access control lists (ACLs) on affected devices. Cisco has released software updates to address this issue, and there are workarounds available.

What happened 🕵️‍♂️

A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software allows an unauthenticated, remote attacker to bypass a configured ACL on affected devices. This occurs when an attacker floods traffic from an unlearned MAC address on a switch virtual interface (SVI) with an egress ACL applied. If the MAC address table is full or flushed, the attacker could successfully bypass the egress ACL.

Affected products 🖥️

The vulnerability affects Cisco Catalyst 9500X and 9600X Series Switches running a vulnerable release of Cisco IOS XE Software with an egress ACL configured on an SVI.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

One workaround is to convert egress ACLs to ingress ACLs. However, this may require extensive configuration changes depending on the number of interfaces configured with egress ACLs. Customers should evaluate the applicability and potential impact of this workaround in their own environments before implementation.

Risk in context 🎯

With a CVSS score of 5.3, this vulnerability is rated as Medium severity. The risk is primarily due to potential unauthorized access to network resources, as an attacker could exploit this vulnerability without authentication. While the vulnerability does not directly impact availability, it could lead to unauthorized data access.

Fast facts ⚡

• Vulnerability ID: CVE-2025-20316
• CVSS Score: 5.3 (Medium)
• Affected Products: Cisco Catalyst 9500X and 9600X Series Switches
• Exploitation Potential: Unauthenticated remote access
• Workaround Available: Yes, but requires careful evaluation

For leadership 🧭

Executive summary. A design flaw in how ACLs are programmed on Catalyst 9500X and 9600X switches means egress filtering can be silently bypassed simply by flooding an SVI with unknown MAC addresses. This is medium severity with no evidence of active exploitation, so it warrants a planned fix rather than an emergency change.

Why it matters:

• Affects only Catalyst 9500X and 9600X switches running Cisco IOS XE with an egress ACL configured on a switch virtual interface (SVI) — a common pattern for segmenting traffic between VLANs.
• The bypass requires no authentication: an attacker only needs to send enough traffic from unlearned MAC addresses to fill or flush the MAC address table.
• Once the table is full or flushed, traffic that should be blocked by the egress ACL can pass through unfiltered, undermining whatever segmentation or access control policy that ACL was enforcing.
• The suggested workaround — converting egress ACLs to ingress ACLs — is not a drop-in fix and may require significant reconfiguration across every affected interface.

Now / Next / Later:

• Now: Identify which Catalyst 9500X and 9600X switches in your estate have egress ACLs applied to SVIs, since only that specific configuration is exposed.
• Next: Upgrade affected devices to a fixed Cisco IOS XE release in your next maintenance window, or, where an upgrade isn’t yet feasible, evaluate converting the affected egress ACLs to ingress ACLs after testing for configuration impact.
• Later: Review switch configuration standards to prefer ingress ACL enforcement on SVIs where practical, and track Cisco IOS XE advisories for this platform to catch related ACL-programming issues early.