Cisco Vulnerabilities

Q: Which Cisco products have the most exploited vulnerabilities?

IOS and IOS XE Software: 14 CVEs (14 in KEV) Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD): 6 CVEs (6 in KEV) IOS software: 6 CVEs (6 in KEV) IOS XR: 6 CVEs (6 in KEV) Catalyst SD-WAN Manager: 5 CVEs (5 in KEV)

Cisco sells networking and security products, including routers and switches that run Cisco IOS and IOS XE software and the Secure Firewall ASA (Adaptive Security Appliance) line. The database tracks 101 Cisco CVE records. CISA lists 100 of them as exploited in the wild, most recently on 2026-09-30. The most affected products are IOS and IOS XE Software, Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD), IOS software.

CVEsCVE Records

101

ExploitedActively Exploited

100

RansomwareRansomware Use

Latest KEVLatest KEV Add

2026-09-30

Recently Exploited Cisco CVEs

CVE-2026-765049.8 CRITICAL

Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

CiscoKEVEPSS 1.8%2026-09-30

CVE-2026-7646010 CRITICAL

Cisco Identity Services Engine Authentication Bypass Vulnerability

CiscoKEVEPSS 14.0%2026-09-16

CVE-2026-764619.8 CRITICAL

Cisco Secure Email Gateway SQL Injection Vulnerability

CiscoKEVEPSS 28.3%2026-09-14

CVE-2026-2007910 CRITICAL

Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability

CiscoKEVEPSS 88.2%2026-03-04

CVE-2026-203498.6 HIGH

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability

CiscoKEVEPSS 1.0%2026-08-11

CVE-2026-203165.3 MEDIUM

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

CiscoKEVEPSS 35.1%2026-07-29

Affected Products

44 products

Product	CVEs	KEV	Latest
IOS and IOS XE Software	14	14	2023-04-19
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)	6	6	2024-10-24
IOS software	6	6	2022-03-03
IOS XR	6	6	2022-05-23
Catalyst SD-WAN Manager	5	5	2026-09-30
Small Business RV160, RV260, RV340, and RV345 Series Routers	5	5	2022-03-03
Adaptive Security Appliance (ASA)	4	4	2024-11-12
IOS and IOS XE	4	4	2025-09-29
IOS Software	4	4	2022-03-03
Identity Services Engine	3	3	2026-09-16
IOS Software and Cisco IOS XE Software	3	3	2022-03-03
AnyConnect Secure	2	2	2022-10-24
HyperFlex HX	2	2	2021-11-03
IOS	2	2	2026-07-13
IOS XE Software	2	2	2022-03-03
IOS, XR, and XE Software	2	2	2022-03-03
Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense	2	2	2025-09-25
Secure Firewall Management Center (FMC)	2	2	2026-07-29
Unified Communications Manager	2	2	2026-06-25
Adaptive Security Appliance and Firepower Threat Defense	1	1	2023-09-13
Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches	1	1	2022-03-03
Catalyst 6800 Series Switches	1	1	2022-03-03
Catalyst SD-WAN	1	1	2026-05-14
Catalyst SD-WAN Controller and Manager	1	1	2026-02-25
Catalyst SD-WAN Manger	1	1	2026-04-20
Cisco Identity Services Engine Software	1	-	2026-04-15
Cisco IOS XE Web UI	1	1	2023-10-23
Cisco IP Phones	1	1	2021-11-03
IOS XE Web UI	1	1	2023-10-16
IOS, IOS XR, and IOS XE	1	1	2023-05-19
Multiple Products	1	1	2025-12-17
NX-OS	1	1	2024-07-02
Prime Data Center Network Manager (DCNM)	1	1	2022-03-25
RV Series Routers	1	1	2022-06-08
SD-WAN	1	1	2026-02-25
Secure Access Control System (ACS)	1	1	2022-03-25
Secure Email Gateway	1	1	2026-09-14
Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)	1	1	2026-08-11
Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management	1	1	2026-09-09
Small Business RV Series Routers	1	1	2025-03-03
Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers	1	1	2022-03-03
Small Business RV320 and RV325 Routers	1	1	2021-11-03
Smart Licensing Utility	1	1	2025-03-31
VPN Routers	1	1	2022-03-25

Security Advisories

Cisco Security Advisories

https://sec.cloudapps.cisco.com/security/center/publicationListing.x

Weakness Types

Improper Input Validation17 Resource Management Errors10 Stack-based Buffer Overflow5 Improper Restriction of Memory Buffer Bounds3 Exposure of Sensitive Information2 Uncontrolled Resource Consumption2 OS Command Injection2 Deserialization of Untrusted Data1 Improper Access Control1 Cross-Site Scripting1

All Cisco CVEs

101 records

CVE	Title	Vendor	CVSS	EPSS	KEV	Published
CVE-2026-76504	Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability	Cisco	9.8	1.8%	KEV	2026-09-30
CVE-2026-76460	Cisco Identity Services Engine Authentication Bypass Vulnerability	Cisco	10.0	14.0%	KEV	2026-09-16
CVE-2026-76461	Cisco Secure Email Gateway SQL Injection Vulnerability	Cisco	9.8	28.3%	KEV	2026-09-14
CVE-2026-20079	Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability	Cisco	10.0	88.2%	KEV	2026-03-04
CVE-2026-20349	Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability	Cisco	8.6	1.0%	KEV	2026-08-11
CVE-2026-20316	Cisco Secure Firewall Management Center Software Static Credential Vulnerability	Cisco	5.3	35.1%	KEV	2026-07-29
CVE-2008-4128	Cisco IOS Cross-Site Request Forgery Vulnerability	-	8.1	33.9%	KEV	2008-09-18
CVE-2026-20230	Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability	Cisco	8.6	88.2%	KEV	2026-06-03
CVE-2026-20262	Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability	Cisco	6.5	28.2%	KEV	2026-06-15
CVE-2026-20245	Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability	Cisco	7.8	25.3%	KEV	2026-06-04
CVE-2026-20182	Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability	Cisco	10.0	91.5%	KEV	2026-05-14
CVE-2026-20133	Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability	Cisco	6.5	31.8%	KEV	2026-02-25
CVE-2026-20122	Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability	Cisco	5.4	25.0%	KEV	2026-02-25
CVE-2026-20128	Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability	Cisco	7.5	7.1%	KEV	2026-02-25
CVE-2026-20131	Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability	Cisco	10.0	43.2%	KEV	2026-03-04
CVE-2026-20127	Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability	Cisco	10.0	88.5%	KEV	2026-02-25
CVE-2022-20775	Cisco SD-WAN Software Privilege Escalation Vulnerability	Cisco	7.8	12.5%	KEV	2022-09-30
CVE-2026-20045	Cisco Unified Communications Products Remote Code Execution Vulnerability	Cisco	8.2	4.5%	KEV	2026-01-21
CVE-2025-20393	Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability	Cisco	10.0	32.4%	KEV	2025-12-17
CVE-2025-20352	Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability	Cisco	7.7	39.4%	KEV	2025-09-24
CVE-2025-20362	Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability	Cisco	6.5	87.1%	KEV	2025-09-25
CVE-2025-20333	Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability	Cisco	9.9	70.7%	KEV	2025-09-25
CVE-2025-20281	Cisco ISE API Unauthenticated Remote Code Execution Vulnerability	Cisco	10.0	97.6%	KEV	2025-06-25
CVE-2025-20337	Cisco ISE API Unauthenticated Remote Code Execution Vulnerability	Cisco	10.0	68.0%	KEV	2025-07-16
CVE-2024-20439	Cisco Smart Licensing Utility Static Credential Vulnerability	Cisco	9.8	97.1%	KEV	2024-09-04
CVE-2023-20118	Cisco Small Business RV Series Routers Command Injection Vulnerability	Cisco	6.5	54.1%	KEV	2023-04-05
CVE-2014-2120	Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability	-	5.4	22.6%	KEV	2014-03-19
CVE-2024-20481	Cisco ASA and FTD Denial-of-Service Vulnerability	Cisco	5.8	15.9%	KEV	2024-10-23
CVE-2024-20399	Cisco NX-OS Software CLI Command Injection Vulnerability	Cisco	6.0	4.3%	KEV	2024-07-01
CVE-2024-20353	Cisco ASA and FTD Denial of Service Vulnerability	Cisco	8.6	70.7%	KEV	2024-04-24
CVE-2024-20359	Cisco ASA and FTD Privilege Escalation Vulnerability	Cisco	6.0	19.4%	KEV	2024-04-24
CVE-2020-3259	Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability	Cisco	7.5	71.8%	KEV	2020-05-06
CVE-2023-20273	Cisco IOS XE Web UI Command Injection Vulnerability	Cisco	7.2	89.6%	KEV	2023-10-24
CVE-2023-20198	Cisco IOS XE Web UI Privilege Escalation Vulnerability	Cisco	10.0	99.6%	KEV	2023-10-16
CVE-2023-20109	Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability	Cisco	6.6	2.5%	KEV	2023-09-27
CVE-2023-20269	Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability	Cisco	5.0	25.5%	KEV	2023-09-06
CVE-2016-6415	Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability	-	7.5	87.7%	KEV	2016-09-19
CVE-2004-1464	Cisco IOS Denial-of-Service Vulnerability	-	5.9	4.8%	KEV	2005-02-13
CVE-2017-6742	Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability	Cisco	8.8	21.4%	KEV	2017-07-17
CVE-2020-3153	Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability	Cisco	6.5	28.3%	KEV	2020-02-19
CVE-2020-3433	Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability	Cisco	7.8	10.0%	KEV	2020-08-17
CVE-2019-15271	Cisco Small Business RV016, RV042, RV042G, and RV082 Routers Arbitrary Command Execution Vulnerability	Cisco	8.8	5.5%	KEV	2019-11-26
CVE-2016-6366	Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability	-	8.8	87.6%	KEV	2016-08-18
CVE-2016-6367	Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability	-	7.8	22.6%	KEV	2016-08-18
CVE-2022-20821	Cisco IOS XR Software Health Check Open Port Vulnerability	Cisco	6.5	11.5%	KEV	2022-05-26
CVE-2017-3881	Cisco IOS and IOS XE Remote Code Execution Vulnerability	-	9.8	99.0%	KEV	2017-03-17
CVE-2018-0125	Cisco VPN Routers Remote Code Execution Vulnerability	-	9.8	55.2%	KEV	2018-02-08
CVE-2015-0666	Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability	-	7.5	40.4%	KEV	2015-04-03
CVE-2018-0147	Cisco Secure Access Control System Java Deserialization Vulnerability	-	9.8	18.2%	KEV	2018-03-08
CVE-2010-3035	Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability	-	7.5	5.7%	KEV	2010-08-30
CVE-2009-2055	Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability	-	5.9	3.3%	KEV	2009-08-19
CVE-2019-1652	Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability	Cisco	7.2	95.9%	KEV	2019-01-24
CVE-2022-20699	Cisco Small Business RV Series Routers Vulnerabilities	Cisco	10.0	72.5%	KEV	2022-02-10
CVE-2017-6736	Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability	Cisco	8.8	70.4%	KEV	2017-07-17
CVE-2017-6737	Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability	Cisco	8.8	45.2%	KEV	2017-07-17
CVE-2022-20708	Cisco Small Business RV Series Routers Vulnerabilities	Cisco	10.0	14.9%	KEV	2022-02-10
CVE-2018-0151	Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability	-	9.8	14.2%	KEV	2018-03-28
CVE-2017-12240	Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability	-	9.8	13.8%	KEV	2017-09-28
CVE-2017-6740	Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability	Cisco	8.8	11.1%	KEV	2017-07-17
CVE-2017-6738	Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability	Cisco	8.8	10.9%	KEV	2017-07-17
CVE-2017-6739	Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability	IntelliShield	8.8	10.9%	KEV	2017-07-17
CVE-2017-6743	Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability	Cisco	8.8	10.9%	KEV	2017-07-17
CVE-2022-20701	Cisco Small Business RV Series Routers Vulnerabilities	Cisco	10.0	9.7%	KEV	2022-02-10
CVE-2018-0156	Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability	-	7.5	9.4%	KEV	2018-03-28
CVE-2022-20703	Cisco Small Business RV Series Routers Vulnerabilities	Cisco	10.0	9.2%	KEV	2022-02-10
CVE-2018-0172	Cisco IOS and IOS XE Software Improper Input Validation Vulnerability	-	8.6	7.8%	KEV	2018-03-28
CVE-2018-0155	Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability	-	8.6	7.7%	KEV	2018-03-28
CVE-2018-0173	Cisco IOS and IOS XE Software Improper Input Validation Vulnerability	-	8.6	7.6%	KEV	2018-03-28
CVE-2018-0174	Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability	-	8.6	7.6%	KEV	2018-03-28
CVE-2017-6744	Cisco IOS Software SNMP Remote Code Execution Vulnerability	Cisco	8.8	7.3%	KEV	2017-07-17
CVE-2018-0158	Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability	-	8.6	7.2%	KEV	2018-03-28
CVE-2017-12231	Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability	-	7.5	7.1%	KEV	2017-09-28
CVE-2017-12233	Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability	-	7.5	7.1%	KEV	2017-09-28
CVE-2017-12234	Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability	-	7.5	7.1%	KEV	2017-09-28
CVE-2017-12235	Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability	-	7.5	7.1%	KEV	2017-09-28
CVE-2017-12237	Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability	-	7.5	7.1%	KEV	2017-09-28
CVE-2018-0154	Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability	-	7.5	7.1%	KEV	2018-03-28
CVE-2018-0159	Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability	-	7.5	6.9%	KEV	2018-03-28
CVE-2017-6627	Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability	-	7.5	6.2%	KEV	2017-09-07
CVE-2022-20700	Cisco Small Business RV Series Routers Vulnerabilities	Cisco	10.0	5.7%	KEV	2022-02-10
CVE-2017-12319	Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability	-	5.9	5.2%	KEV	2018-03-27
CVE-2018-0179	Cisco IOS Software Denial-of-Service Vulnerability	-	6.8	4.9%	KEV	2018-03-28
CVE-2018-0180	Cisco IOS Software Denial-of-Service Vulnerability	-	6.8	4.9%	KEV	2018-03-28
CVE-2018-0161	Cisco IOS Software Resource Management Errors Vulnerability	-	6.3	4.1%	KEV	2018-03-28
CVE-2018-0175	Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability	-	8.0	3.5%	KEV	2018-03-28
CVE-2018-0167	Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability	-	8.8	3.4%	KEV	2018-03-28
CVE-2017-12232	Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability	-	6.5	2.2%	KEV	2017-09-28
CVE-2017-6663	Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability	-	6.5	2.1%	KEV	2017-08-07
CVE-2017-12238	Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability	-	6.5	2.0%	KEV	2017-09-28
CVE-2021-1498	Cisco HyperFlex HX Command Injection Vulnerabilities	Cisco	9.8	100.0%	KEV	2021-05-06
CVE-2020-3452	Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability	Cisco	7.5	100.0%	KEV	2020-07-22
CVE-2021-1497	Cisco HyperFlex HX Command Injection Vulnerabilities	Cisco	9.8	99.9%	KEV	2021-05-06
CVE-2018-0296	Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability	-	7.5	99.9%	KEV	2018-06-07
CVE-2019-1653	Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability	Cisco	7.5	99.9%	KEV	2019-01-24
CVE-2018-0171	Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability	-	7.5	99.5%	KEV	2018-03-28
CVE-2020-3580	Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities	Cisco	6.1	85.6%	KEV	2020-10-21
CVE-2020-3161	Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability	Cisco	9.8	83.9%	KEV	2020-04-15
CVE-2020-3118	Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability	Cisco	8.8	11.7%	KEV	2020-02-05
CVE-2020-3566	Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability	Cisco	8.6	3.7%	KEV	2020-08-29
CVE-2020-3569	Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities	Cisco	8.6	3.3%	KEV	2020-09-23
CVE-2026-20147	Cisco Identity Services Engine Remote Code Execution Vulnerability	Cisco	9.9	10.4%		2026-04-15

Frequently Asked Questions

How many Cisco vulnerabilities are actively exploited?→

100 Cisco CVEs are in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-09. The latest was added on 2026-09-30.

Which Cisco vulnerabilities are used in ransomware attacks?→

CISA marks 7 Cisco KEV entries as known to be used in ransomware campaigns, including CVE-2026-20316, CVE-2026-20131, CVE-2020-3259, CVE-2023-20269, CVE-2020-3153.

Which Cisco products have the most exploited vulnerabilities?→

+IOS and IOS XE Software: 14 CVEs (14 in KEV)
+Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD): 6 CVEs (6 in KEV)
+IOS software: 6 CVEs (6 in KEV)
+IOS XR: 6 CVEs (6 in KEV)
+Catalyst SD-WAN Manager: 5 CVEs (5 in KEV)

Where does Cisco publish security advisories?→

Cisco publishes security advisories at https://sec.cloudapps.cisco.com/security/center/publicationListing.x. Check the vendor advisory for fixed versions and workarounds before applying updates.

Sources

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Vendor and product names for exploited CVEs follow the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not affiliated with or endorsed by Cisco, MITRE, CISA, or FIRST.