Is CVE-2009-2055 (Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service) being exploited in the wild?

Yes. CISA added CVE-2009-2055 to its Known Exploited Vulnerabilities catalogue on 25 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS). Any organisation running the affected product should treat remediation as urgent.

What it means when a BGP flaw is confirmed as exploited

CISA does not place a vulnerability in its Known Exploited Vulnerabilities catalogue lightly. For this case, the practical question is not whether the issue is theoretical, but whether exposure exists on systems that run Cisco IOS XR with BGP enabled. For routing infrastructure, that is a material operational and security concern because loss of control over a core routing plane can affect availability well beyond the affected box.

Because the issue sits in routing infrastructure, the first response should be to treat it as a service continuity problem as well as a software defect. If the platform is in production, confirm whether BGP is enabled, whether the device is internet reachable, and whether there are compensating controls around management access, change control, and routing policy. BGP and Routing Security Guide is the most relevant baseline for understanding the surrounding routing-security controls.

For the wider remediation workflow, use the vendor advisory and the KEV catalogue as the authoritative source for version specifics and required action. When a routing flaw is actively exploited, the important decision is not just patching speed, but whether the device can stay safely online long enough to complete a controlled fix.

Why active exploitation changes the priority

Active exploitation changes this from routine vulnerability management to urgent exposure reduction. Once a routing flaw is known to be in use, defenders should assume attackers may already be probing for the same condition across exposed infrastructure, especially where the device is externally reachable or operationally hard to patch. The safest interpretation is that exploitation pressure exists until the asset is remediated or effectively isolated.

That is why routing-device cases should be handled with the same urgency you would use for other actively exploited vulnerabilities. The operational risk is not limited to a crash or reboot, because a routing-plane issue can interrupt reachability, destabilise adjacent networks, or force emergency changes under pressure.

When the issue is tied to BGP, the failure can also have blast-radius implications beyond the local host. Even if the vulnerability does not grant code execution, a denial-of-service condition in routing can still create a business-visible outage, traffic blackholing, or loss of upstream connectivity.

How to verify exposure and contain the blast radius

The immediate task is to establish whether the asset is actually in scope. Inventory the exact Cisco IOS XR instances, check whether BGP is configured, and determine whether the device can be reached from untrusted networks. If the routing function is in use, validate whether there is a maintenance window, an alternate path, or a failover design before you touch it.

Confirm the precise device role, not just the product family.
Check whether BGP is enabled in the live configuration.
Review whether the platform is exposed to the internet or to broad partner networks.
Preserve logs and routing telemetry before making changes, so you can detect earlier compromise or repeated probing.

If patching must wait, the priority is containment. Reduce reachability, tighten management exposure, and monitor for instability or repeated fault conditions. For teams that need a concrete vulnerability-response process, the Vulnerability Management Guide is useful for turning KEV status into prioritisation, exception handling, and verification steps.

Risk and Threat Considerations

Routing infrastructure is a high-value target because it can disrupt availability with relatively little noise compared with a data breach. If BGP handling fails under exploitation, the result can be service interruption, routing instability, or forced failover at exactly the time operators have the least room for error.

Failure mechanism: The flaw allows a remote attacker to trigger denial of service in Cisco IOS XR when BGP is configured, so the attack path is focused on availability rather than credential theft or data exfiltration.

Impact: Loss of routing service can cascade into customer outages, partner connectivity loss, incident escalation, and emergency operational changes across dependent networks.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	Routing devices need hardened, validated configurations to reduce exposed attack surface.
	CIS-12 — Network Infrastructure Management	The subject is a network routing component whose security depends on managed infrastructure controls.
Recommendation — Harden IOS XR configurations and remove unnecessary exposure on routing devices. Track, monitor, and maintain routing infrastructure with documented change control.
NIST CSF 2.0	PR.PS-01 — Configuration Management	The issue requires safe configuration and control of a production routing platform.
	DE.CM-01 — Continuous Monitoring	Active exploitation calls for monitoring of routing stability and suspicious change conditions.
	RC.RP-01 — Recovery Plan Execution	DoS on routing infrastructure demands recovery planning and failover readiness.
Recommendation — Maintain secure configurations and track changes on the affected routing systems. Monitor routing behavior and alert on instability or abnormal service disruption. Exercise failover and recovery steps for routing-plane outages.

Practitioner Guidance

What to prioritise: Treat KEV-listed routing flaws as production-stability issues first. If the device carries important traffic, confirm routing redundancy and rollback options before you schedule remediation.

What to verify: Verify whether the vulnerability is present on any IOS XR instance with active BGP use, whether logs show instability, and whether a safe maintenance path exists without interrupting critical routes.

Decision rule: If the platform is internet reachable and BGP is enabled, prioritise remediation ahead of normal patch queues, even when the device appears stable.

Practitioner takeaway: For routing infrastructure, “exploited in the wild” means you should think in terms of outage containment and path resilience, not only patch compliance.