Vulnerabilità per vendor · aggiornato a ogni pubblicazione
Vulnerabilità Cisco: CVE sfruttate e nostre analisi
Cisco ha 101 vulnerabilità nel catalogo CISA Known Exploited Vulnerabilities, 20 delle quali aggiunte negli ultimi 12 mesi e 7 note per l'uso in campagne ransomware. Qui sotto: le 11 analisi pubblicate da Zero Hunt Research sui prodotti Cisco, poi le voci del catalogo dalla più recente, con la scadenza federale.
Catalogo CISA versione 2026.10.21, pubblicato il 2026-10-21 14:04 UTC.
101
CVE in CISA KEV
20
Aggiunte negli ultimi 12 mesi
7
Uso noto nel ransomware
11
Analisi Zero Hunt
Prodotti con più voci nel KEV: IOS and IOS XE Software (14) · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (6) · IOS software (6) · IOS XR (6) · Catalyst SD-WAN Manager (5) · Small Business RV160, RV260, RV340, and RV345 Series Routers (5)
Le nostre analisi delle vulnerabilità Cisco
2026-10-21
Cisco Expressway CVE-2026-76466: RCE non autenticata come root (CVSS 9.8)Un difetto nei cookie persistenti e il mancato controllo dei certificati TLS di cluster consentono RCE non autenticata come root su Cisco Expressway esposto.
2026-10-14
Cisco Secure Email Gateway CVE-2026-76519: scrittura file da root con una email, sfruttataUn allegato email crea file arbitrari da root sul Cisco Secure Email Gateway (CVE-2026-76519, CVSS 9.8). Sfruttata in rete, in KEV, nessun workaround.
2026-10-07
CVE-2026-76455: Cisco NX-OS critica 9.8, sei CVE, senza workaroundCVE-2026-76455 è la critica 9.8 dell'hardening NX-OS di Cisco (ottobre 2026): sei falle su Nexus, MDS e UCS, senza workaround. Ecco la mappa delle patch.
2026-10-03
Cisco IOS XE CVE-2026-20272: una command injection 9.8 senza workaroundL'hardening release IOS XE di agosto 2026 corregge 7 classi di falle: CVE-2026-20272 è una command injection non autenticata 9.8 senza workaround. Mappa patch.
2026-10-01
Cisco Catalyst SD-WAN Manager CVE-2026-76504: una richiesta codificata e sei adminCisco Catalyst SD-WAN Manager CVE-2026-76504, CVSS 9.8: bypass di autenticazione API via URL encoding, già sfruttato. Build corrette, IOC, remediation.
2026-09-19
Cisco ISE CVE-2026-76460: bypass di autenticazione e root sull'autorità di identitàCisco ISE CVE-2026-76460 (CVSS 10.0) è un bypass di autenticazione via API fino a root, sfruttato in the wild. Perché i log dell'autorità di identità non sono affidabili.
2026-09-15
Cisco Secure Email Gateway CVE-2026-76461: una email prende rootUna email costruita ad arte inietta SQL nel parsing di Cisco AsyncOS e ottiene root: niente login, niente click. CVSS 9.8, KEV, scadenza federale 17 set.
2026-09-13
Cisco FMC CVE-2026-20079: il gestore dei firewall diventa root, e sono entrati in treCVE-2026-20079 è un bypass pre-auth CVSS 10 fino a root su Cisco Secure FMC, sfruttato da Sandworm, Qilin e un gruppo crimeware. Applica la patch, cercalo, intercettalo sul filo.
2026-07-30
Cisco FMC CVE-2026-20316: il CVSS 5.3 che CISA ha messo in KEVCisco FMC CVE-2026-20316 è una credenziale statica con punteggio 5.3, sfruttata come zero-day. Il CVSS valuta un bug alla volta, l'attaccante compra la catena.
2026-06-26
Cisco Unified CM CVE-2026-20230: root sul centralino che nessuno controllaCisco ha corretto la falla SSRF CVE-2026-20230 di Unified CM il 3 giugno. Il 22 i payload di scrittura file colpivano già le esche; il 25 CISA l'ha messa in KEV. Il punto: su quell'appliance non puoi installare l'EDR.
2026-05-26
Cisco SD-WAN CVE-2026-20182: la catena downgrade-and-revert che un pentest trimestrale non vedeAuth bypass CVSS 10.0 sui Cisco Catalyst SD-WAN Controller, UAT-8616 attivo dal 2023, e una kill chain che declassa e ripristina il software per cancellare la traccia di versione su cui l'audit si appoggia.
Le ultime 40 di 101 voci KEV
| Aggiunta | CVE | Prodotto e vulnerabilità | Scadenza federale | Segnalazioni | Nostra analisi |
|---|---|---|---|---|---|
| 2026-10-14 | CVE-2026-76519 | Secure Email Gateway Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. | 2026-10-17 | Triage forense | Leggi → |
| 2026-09-30 | CVE-2026-76504 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI e… | 2026-10-03 | Triage forense | Leggi → |
| 2026-09-16 | CVE-2026-76460 | Identity Services Engine Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthoriz… | 2026-09-19 | Triage forense | Leggi → |
| 2026-09-14 | CVE-2026-76461 | Secure Email Gateway Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underly… | 2026-09-17 | Triage forense | Leggi → |
| 2026-09-09 | CVE-2026-20079 | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an u… | 2026-09-12 | Triage forense | Leggi → |
| 2026-08-11 | CVE-2026-20349 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to relo… | 2026-08-14 | — | |
| 2026-07-29 | CVE-2026-20316 | Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affe… | 2026-08-01 | Ransomware | Leggi → |
| 2026-07-13 | CVE-2008-4128 | IOS Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain… | 2026-07-16 | Triage forense | — |
| 2026-06-25 | CVE-2026-20230 | Unified Communications Manager Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an una… | 2026-06-28 | Leggi → | |
| 2026-06-15 | CVE-2026-20262 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. | 2026-06-29 | — | |
| 2026-06-09 | CVE-2026-20245 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as… | 2026-06-23 | — | |
| 2026-05-14 | CVE-2026-20182 | Catalyst SD-WAN Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected sy… | 2026-05-17 | Leggi → | |
| 2026-04-20 | CVE-2026-20133 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems. | 2026-04-23 | — | |
| 2026-04-20 | CVE-2026-20128 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user… | 2026-04-23 | — | |
| 2026-04-20 | CVE-2026-20122 | Catalyst SD-WAN Manger Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by upload… | 2026-04-23 | — | |
| 2026-03-19 | CVE-2026-20131 | Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that co… | 2026-03-22 | Ransomware | — |
| 2026-02-25 | CVE-2026-20127 | Catalyst SD-WAN Controller and Manager Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to b… | 2026-02-27 | — | |
| 2026-02-25 | CVE-2022-20775 | SD-WAN Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful e… | 2026-02-27 | — | |
| 2026-01-21 | CVE-2026-20045 | Unified Communications Manager Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco… | 2026-02-11 | — | |
| 2025-12-17 | CVE-2025-20393 | Multiple Products Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges o… | 2025-12-24 | — | |
| 2025-09-29 | CVE-2025-20352 | IOS and IOS XE Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploi… | 2025-10-20 | — | |
| 2025-09-25 | CVE-2025-20362 | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025… | 2025-09-26 | — | |
| 2025-09-25 | CVE-2025-20333 | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerabilit… | 2025-09-26 | — | |
| 2025-07-28 | CVE-2025-20337 | Identity Services Engine Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerabil… | 2025-08-18 | — | |
| 2025-07-28 | CVE-2025-20281 | Identity Services Engine Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerabil… | 2025-08-18 | — | |
| 2025-03-31 | CVE-2024-20439 | Smart Licensing Utility Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials. | 2025-04-21 | — | |
| 2025-03-03 | CVE-2023-20118 | Small Business RV Series Routers Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-leve… | 2025-03-24 | — | |
| 2024-11-12 | CVE-2014-2120 | Adaptive Security Appliance (ASA) Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecifie… | 2024-12-03 | — | |
| 2024-10-24 | CVE-2024-20481 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a d… | 2024-11-14 | — | |
| 2024-07-02 | CVE-2024-20399 | NX-OS Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affecte… | 2024-07-23 | — | |
| 2024-04-24 | CVE-2024-20359 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root. | 2024-05-01 | — | |
| 2024-04-24 | CVE-2024-20353 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition. | 2024-05-01 | — | |
| 2024-02-15 | CVE-2020-3259 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the dis… | 2024-03-07 | Ransomware | — |
| 2023-10-23 | CVE-2023-20273 | Cisco IOS XE Web UI Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to t… | 2023-10-27 | — | |
| 2023-10-16 | CVE-2023-20198 | IOS XE Web UI Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can the… | 2023-10-20 | — | |
| 2023-10-10 | CVE-2023-20109 | IOS and IOS XE Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a gr… | 2023-10-31 | — | |
| 2023-09-13 | CVE-2023-20269 | Adaptive Security Appliance and Firepower Threat Defense Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identif… | 2023-10-04 | Ransomware | — |
| 2023-05-19 | CVE-2016-6415 | IOS, IOS XR, and IOS XE Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulner… | 2023-06-09 | — | |
| 2023-05-19 | CVE-2004-1464 | IOS Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases, Hypertext Transport Protocol (HTTP) access to the Cisco device. | 2023-06-09 | — | |
| 2023-04-19 | CVE-2017-6742 | IOS and IOS XE Software The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an af… | 2023-05-10 | — |
Fonte: catalogo CISA Known Exploited Vulnerabilities (dati pubblici). Le descrizioni sono di CISA, abbreviate. Verifica sempre l'advisory del vendor prima di intervenire. cisa.gov
Prima della patch: tre verifiche
- 01Confronta la versione e la configurazione esatte che usi con l'advisory del vendor. Avere il prodotto non significa essere esposti.
- 02Verifica la raggiungibilità: una falla sfruttata su un'interfaccia raggiungibile da internet, o da una postazione compromessa, passa in testa alla coda.
- 03Dove CISA indica il triage forense, oltre alla patch cerca tracce di compromissione: la correzione non elimina un attaccante entrato prima.
Domande
Quante vulnerabilità Cisco ci sono nel catalogo CISA KEV?
101 nella versione 2026.10.21 del catalogo, la prima aggiunta il 2021-11-03 e la più recente il 2026-10-14. 20 sono state aggiunte negli ultimi 12 mesi.
Quali prodotti Cisco hanno più vulnerabilità sfruttate?
Per numero di voci KEV: IOS and IOS XE Software (14), Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (6), IOS software (6), IOS XR (6), Catalyst SD-WAN Manager (5), Small Business RV160, RV260, RV340, and RV345 Series Routers (5).
Le vulnerabilità Cisco sono usate negli attacchi ransomware?
CISA indica 7 delle 101 voci Cisco come note per l'uso in campagne ransomware. Nella tabella sono segnalate.
La prossima CVE Cisco è sfruttabile nella tua rete?
Una voce KEV dice che una vulnerabilità è sfruttata da qualche parte. Zero Hunt risponde se è sfruttabile nel tuo ambiente: un red team AI autonomo su un'appliance on-premise, con AI privata, in black box o gray box e con una persona che approva ogni passo che conta.
Altri vendor: Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Atlassian · Zyxel · Progress · F5