Is CVE-2010-3035 (Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2010-3035 to its Known Exploited Vulnerabilities catalogue on 25 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS). Any organisation running the affected product should treat remediation as urgent.

Why active exploitation changes the response for CVE-2010-3035

Once a Cisco IOS XR BGP DoS flaw is confirmed as being exploited in the wild, the question is no longer theoretical exposure, it is whether your routing edge can still be trusted to stay available under pressure. That shifts the priority from normal change planning to urgent validation, mitigation, and exposure reduction.

For routing infrastructure, availability is the primary security outcome. A remote DoS against BGP on a live IOS XR deployment can affect control-plane stability, route handling, and service reachability, so the operational impact can extend well beyond the router itself.

Use the BGP and Routing Security Guide to frame the issue as a routing-security problem, not just a device bug, and the Edge Device Security Guide to account for management exposure, logging, and patch urgency on internet-facing network appliances.

What exposure to confirm before you assume you are safe

First confirm whether IOS XR is deployed anywhere BGP is enabled as the configured routing feature, because that is the condition the direct answer identifies as relevant. Then determine whether the affected nodes sit on paths that would make a control-plane outage material to business continuity, interconnectivity, or upstream routing stability.

You should also verify whether the vulnerable systems are externally reachable or reachable through a shared management plane, since the practical risk is not just that the flaw exists but that it can be reached at scale. In network environments, one exposed routing platform can become a concentration point for availability failure.

Use the CISA Known Exploited Vulnerabilities Catalog as the authoritative signal that this is not a hypothetical issue, and the NIST National Vulnerability Database for the canonical CVE record and product context.

How to reduce risk while remediation is still being scheduled

Because CISA has already treated this CVE as actively exploited, remediation should be handled as an emergency operational task, not as a routine backlog item. If you cannot patch immediately, your fallback should be to reduce exposure, validate routing behavior, and constrain the attack surface around the affected device until the vendor fix is in place.

That usually means reviewing whether the vulnerable BGP service is necessary on every deployment, tightening access to adjacent management and peering paths, and increasing monitoring for instability or repeated control-plane faults. For routing devices, the most useful temporary mitigations are the ones that remove reachability, not just the ones that document the problem.

Refer to the vendor advisory for exact affected and fixed versions, and use the Zero-Day and Exploited Vulnerabilities Guide to structure your emergency triage, verification, and post-fix hunting approach.

Risk and Threat Considerations

An actively exploited routing flaw is dangerous because the attacker does not need to steal credentials or persist for long to create damage. A remote denial-of-service against BGP can interrupt forwarding, destabilize peering, and trigger cascading availability issues across services that depend on the router’s control plane.

Failure mechanism: An attacker sends traffic that exercises the vulnerable BGP handling path on Cisco IOS XR, causing the routing process or device to fail or become unstable.

Impact: The result can be loss of routing availability, service interruption, and operational churn while teams recover the device and restore stable routing.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited CVEs require rapid identification and remediation.
Recommendation — Prioritise exposed IOS XR assets for emergency remediation and validation.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE demands urgent flaw remediation on affected routing infrastructure.
	SC-5 — Denial of Service Protection	The flaw enables remote DoS against routing services.
Recommendation — Track and remediate the IOS XR flaw through emergency patch and verification actions. Apply DoS protections and containment measures around vulnerable routing paths.
NIST CSF 2.0	PR.PS-06 — Least Functionality	Reducing exposed routing functions lowers the attack surface for the vulnerable BGP service.
	DE.CM-01 — Networks and Network Services Are Monitored to Find Events	Active exploitation calls for monitoring routing instability and attack indicators.
Recommendation — Disable or restrict unnecessary routing exposure on vulnerable devices. Monitor affected networks for routing anomalies and instability during remediation.

Practitioner Guidance

What to verify: Identify every IOS XR instance where BGP is enabled, then confirm whether each one is internet-reachable, peering-reachable, or reachable through shared network paths that could expose it to hostile traffic.

Decision rule: If the device is exposed and cannot be remediated immediately, treat containment as part of the fix, not a separate activity. Temporary reduction of reachability is justified when the alternative is leaving an actively exploited control-plane flaw open.

What good looks like: You can state, for each affected node, whether it has been patched or isolated, whether routing remains stable after validation, and whether monitoring is in place to detect renewed instability.

Practitioner takeaway: For an exploited routing CVE, the real test is not whether the bug is understood, but whether you can quickly prove which routing assets are exposed and remove the attack path before availability is lost.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org