Vulnerabilities by vendor · updated on every deploy
Cisco vulnerabilities: exploited CVEs and our analysis
Cisco has 101 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 20 of them added in the last 12 months and 7 known to be used in ransomware campaigns. Below: the 11 analyses Zero Hunt Research published on Cisco products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
101
CVEs in CISA KEV
20
Added in the last 12 months
7
Known ransomware use
11
Zero Hunt analyses
Products with the most KEV entries: IOS and IOS XE Software (14) · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (6) · IOS software (6) · IOS XR (6) · Catalyst SD-WAN Manager (5) · Small Business RV160, RV260, RV340, and RV345 Series Routers (5)
Our analysis of Cisco vulnerabilities
2026-10-21
Cisco Expressway CVE-2026-76466: unauthenticated RCE to root (CVSS 9.8)A persistent-cookie flaw plus missing cluster TLS certificate checks let an unauthenticated attacker run commands as root on internet-facing Cisco Expressway.
2026-10-14
Cisco Secure Email Gateway CVE-2026-76519: root file write from a single email, exploitedA crafted email writes arbitrary files as root on Cisco Secure Email Gateway (CVE-2026-76519, CVSS 9.8). Exploited in the wild, KEV-listed, no workaround.
2026-10-07
CVE-2026-76455: Cisco NX-OS 9.8 critical, six CVEs, no workaroundCVE-2026-76455 is the 9.8 critical in Cisco's October 2026 NX-OS hardening release — six flaws in Nexus, MDS and UCS, no workaround. Here's the patch map.
2026-10-03
Cisco IOS XE CVE-2026-20272: an AI-found 9.8 with no workaroundCisco's August 2026 IOS XE hardening release fixes 7 flaw classes — CVE-2026-20272 is a 9.8 unauthenticated command injection with no workaround. Patch map inside.
2026-10-01
Cisco Catalyst SD-WAN Manager CVE-2026-76504: one encoded request to the admin APICisco Catalyst SD-WAN Manager CVE-2026-76504, CVSS 9.8, is an API auth bypass via URL encoding — exploited in the wild. Fixed builds, IOCs, remediation.
2026-09-19
Cisco ISE CVE-2026-76460: Auth Bypass to Root on the Identity AuthorityCisco ISE CVE-2026-76460 (CVSS 10.0) is an unauthenticated API auth bypass to root, exploited in the wild. Why the identity authority's own logs can't be trusted.
2026-09-15
Cisco Secure Email Gateway CVE-2026-76461: an inbound email gets rootA crafted email injects SQL into Cisco AsyncOS mail parsing and lands root — no login, no click. CVSS 9.8, KEV, federal deadline 17 Sept. Patch, then hunt the wire.
2026-09-13
Cisco FMC CVE-2026-20079: the Firewall Manager Roots Itself, and Three Crews Walked InCVE-2026-20079 is a CVSS 10 pre-auth bypass to root on Cisco Secure FMC, exploited by Sandworm, Qilin, and a crimeware crew. Patch it, hunt it, catch it on the wire.
2026-07-30
Cisco FMC CVE-2026-20316: the CVSS 5.3 that CISA put in KEVCisco FMC CVE-2026-20316 is a static credential scored 5.3 and exploited as a zero-day. CVSS scores one bug at a time; attackers buy the whole chain.
2026-06-26
Cisco Unified CM CVE-2026-20230: Root on the Phone System Nobody WatchesCisco patched Unified CM's SSRF flaw CVE-2026-20230 on June 3. Attackers had file-write payloads landing by June 22 and CISA added it to KEV on June 25. The catch: you can't run EDR on the appliance.
2026-05-26
Cisco SD-WAN CVE-2026-20182: the downgrade-and-revert chain a quarterly pentest cannot catchCVSS 10.0 auth bypass on Cisco Catalyst SD-WAN Controller, UAT-8616 active since 2023, and a downgrade-then-revert kill chain that erases the version trail point-in-time audits depend on.
Latest 40 of 101 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-10-14 | CVE-2026-76519 | Secure Email Gateway Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. | 2026-10-17 | Forensic triage | Read → |
| 2026-09-30 | CVE-2026-76504 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI e… | 2026-10-03 | Forensic triage | Read → |
| 2026-09-16 | CVE-2026-76460 | Identity Services Engine Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthoriz… | 2026-09-19 | Forensic triage | Read → |
| 2026-09-14 | CVE-2026-76461 | Secure Email Gateway Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underly… | 2026-09-17 | Forensic triage | Read → |
| 2026-09-09 | CVE-2026-20079 | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an u… | 2026-09-12 | Forensic triage | Read → |
| 2026-08-11 | CVE-2026-20349 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to relo… | 2026-08-14 | — | |
| 2026-07-29 | CVE-2026-20316 | Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affe… | 2026-08-01 | Ransomware | Read → |
| 2026-07-13 | CVE-2008-4128 | IOS Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain… | 2026-07-16 | Forensic triage | — |
| 2026-06-25 | CVE-2026-20230 | Unified Communications Manager Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an una… | 2026-06-28 | Read → | |
| 2026-06-15 | CVE-2026-20262 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. | 2026-06-29 | — | |
| 2026-06-09 | CVE-2026-20245 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as… | 2026-06-23 | — | |
| 2026-05-14 | CVE-2026-20182 | Catalyst SD-WAN Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected sy… | 2026-05-17 | Read → | |
| 2026-04-20 | CVE-2026-20133 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems. | 2026-04-23 | — | |
| 2026-04-20 | CVE-2026-20128 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user… | 2026-04-23 | — | |
| 2026-04-20 | CVE-2026-20122 | Catalyst SD-WAN Manger Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by upload… | 2026-04-23 | — | |
| 2026-03-19 | CVE-2026-20131 | Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that co… | 2026-03-22 | Ransomware | — |
| 2026-02-25 | CVE-2026-20127 | Catalyst SD-WAN Controller and Manager Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to b… | 2026-02-27 | — | |
| 2026-02-25 | CVE-2022-20775 | SD-WAN Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful e… | 2026-02-27 | — | |
| 2026-01-21 | CVE-2026-20045 | Unified Communications Manager Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco… | 2026-02-11 | — | |
| 2025-12-17 | CVE-2025-20393 | Multiple Products Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges o… | 2025-12-24 | — | |
| 2025-09-29 | CVE-2025-20352 | IOS and IOS XE Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploi… | 2025-10-20 | — | |
| 2025-09-25 | CVE-2025-20362 | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025… | 2025-09-26 | — | |
| 2025-09-25 | CVE-2025-20333 | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerabilit… | 2025-09-26 | — | |
| 2025-07-28 | CVE-2025-20337 | Identity Services Engine Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerabil… | 2025-08-18 | — | |
| 2025-07-28 | CVE-2025-20281 | Identity Services Engine Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerabil… | 2025-08-18 | — | |
| 2025-03-31 | CVE-2024-20439 | Smart Licensing Utility Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials. | 2025-04-21 | — | |
| 2025-03-03 | CVE-2023-20118 | Small Business RV Series Routers Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-leve… | 2025-03-24 | — | |
| 2024-11-12 | CVE-2014-2120 | Adaptive Security Appliance (ASA) Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecifie… | 2024-12-03 | — | |
| 2024-10-24 | CVE-2024-20481 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a d… | 2024-11-14 | — | |
| 2024-07-02 | CVE-2024-20399 | NX-OS Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affecte… | 2024-07-23 | — | |
| 2024-04-24 | CVE-2024-20359 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root. | 2024-05-01 | — | |
| 2024-04-24 | CVE-2024-20353 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition. | 2024-05-01 | — | |
| 2024-02-15 | CVE-2020-3259 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the dis… | 2024-03-07 | Ransomware | — |
| 2023-10-23 | CVE-2023-20273 | Cisco IOS XE Web UI Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to t… | 2023-10-27 | — | |
| 2023-10-16 | CVE-2023-20198 | IOS XE Web UI Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can the… | 2023-10-20 | — | |
| 2023-10-10 | CVE-2023-20109 | IOS and IOS XE Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a gr… | 2023-10-31 | — | |
| 2023-09-13 | CVE-2023-20269 | Adaptive Security Appliance and Firepower Threat Defense Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identif… | 2023-10-04 | Ransomware | — |
| 2023-05-19 | CVE-2016-6415 | IOS, IOS XR, and IOS XE Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulner… | 2023-06-09 | — | |
| 2023-05-19 | CVE-2004-1464 | IOS Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases, Hypertext Transport Protocol (HTTP) access to the Cisco device. | 2023-06-09 | — | |
| 2023-04-19 | CVE-2017-6742 | IOS and IOS XE Software The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an af… | 2023-05-10 | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many Cisco vulnerabilities are in the CISA KEV catalog?
101 in catalog version 2026.10.21, the first added on 2021-11-03 and the most recent on 2026-10-14. 20 were added in the last 12 months.
Which Cisco products have the most exploited vulnerabilities?
By KEV entries: IOS and IOS XE Software (14), Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (6), IOS software (6), IOS XR (6), Catalyst SD-WAN Manager (5), Small Business RV160, RV260, RV340, and RV345 Series Routers (5).
Are Cisco vulnerabilities used in ransomware attacks?
CISA marks 7 of the 101 Cisco entries as known to be used in ransomware campaigns. The table flags them.
Is the next Cisco CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Atlassian · Zyxel · Progress · F5