Cisco
101 CVEs in CISA KEV — 7 with confirmed ransomware use
Products
| CVE | Product | CVSS | EPSS | Added | Due | Flags | Description |
|---|---|---|---|---|---|---|---|
CVE-2023-20198 |
IOS XE Web UI | — | 0.9961 | 2023-10-16 | 2023-10-20 | Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web use | |
CVE-2025-20281 |
Identity Services Engine | — | 0.9760 | 2025-07-28 | 2025-08-18 | Cisco Identity Services Engine contains an injection vulnerability in a specific | |
CVE-2024-20439 |
Smart Licensing Utility | — | 0.9709 | 2025-03-31 | 2025-04-21 | Cisco Smart Licensing Utility contains a static credential vulnerability that al | |
CVE-2023-20273 |
Cisco IOS XE Web UI | — | 0.9294 | 2023-10-23 | 2023-10-27 | Cisco IOS XE contains a command injection vulnerability in the web user interfac | |
CVE-2026-20182 |
Catalyst SD-WAN | 10.0 | 0.9182 | 2026-05-14 | 2026-05-17 | Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vuln | |
CVE-2026-20127 |
Catalyst SD-WAN Controller and Manager | — | 0.8929 | 2026-02-25 | 2026-02-27 | Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD- | |
CVE-2026-20079 |
Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | — | 0.8847 | 2026-09-09 | 2026-09-12 | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud | |
CVE-2026-20230 |
Unified Communications Manager | — | 0.8820 | 2026-06-25 | 2026-06-28 | Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communicatio | |
CVE-2025-20362 |
Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | — | 0.8709 | 2025-09-25 | 2025-09-26 | Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Thre | |
CVE-2026-76460 |
Identity Services Engine | — | 0.7560 | 2026-09-16 | 2026-09-19 | Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (I | |
CVE-2025-20337 |
Identity Services Engine | — | 0.7450 | 2025-07-28 | 2025-08-18 | Cisco Identity Services Engine contains an injection vulnerability in a specific | |
CVE-2025-20333 |
Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | — | 0.7121 | 2025-09-25 | 2025-09-26 | Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Thre | |
CVE-2024-20353 |
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | — | 0.6982 | 2024-04-24 | 2024-05-01 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) conta | |
CVE-2023-20118 |
Small Business RV Series Routers | — | 0.5411 | 2025-03-03 | 2025-03-24 | Multiple Cisco Small Business RV Series Routers contains a command injection vul | |
CVE-2026-20131 |
Secure Firewall Management Center (FMC) | — | 0.4317 | 2026-03-19 | 2026-03-22 | RW | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud |
CVE-2025-20352 |
IOS and IOS XE | — | 0.4150 | 2025-09-29 | 2025-10-20 | Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the | |
CVE-2026-76504 |
Catalyst SD-WAN Manager | — | 0.3893 | 2026-09-30 | 2026-10-03 | Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could a | |
CVE-2026-20316 |
Secure Firewall Management Center (FMC) | 5.3 | 0.3510 | 2026-07-29 | 2026-08-01 | RW | Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Manage |
CVE-2025-20393 |
Multiple Products | — | 0.3239 | 2025-12-17 | 2025-12-24 | Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appl | |
CVE-2026-20133 |
Catalyst SD-WAN Manager | — | 0.3148 | 2026-04-20 | 2026-04-23 | Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to a | |
CVE-2026-76461 |
Secure Email Gateway | — | 0.2954 | 2026-09-14 | 2026-09-17 | Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injec | |
CVE-2026-20262 |
Catalyst SD-WAN Manager | — | 0.2912 | 2026-06-15 | 2026-06-29 | Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerabili | |
CVE-2023-20269 |
Adaptive Security Appliance and Firepower Threat Defense | — | 0.2662 | 2023-09-13 | 2023-10-04 | RW | Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauth |
CVE-2026-20122 |
Catalyst SD-WAN Manger | — | 0.2580 | 2026-04-20 | 2026-04-23 | Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulne | |
CVE-2026-20245 |
Catalyst SD-WAN Manager | — | 0.2532 | 2026-06-09 | 2026-06-23 | Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encod | |
CVE-2024-20359 |
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | — | 0.1882 | 2024-04-24 | 2024-05-01 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) conta | |
CVE-2024-20481 |
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | — | 0.1587 | 2024-10-24 | 2024-11-14 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) conta | |
CVE-2026-20128 |
Catalyst SD-WAN Manager | — | 0.0732 | 2026-04-20 | 2026-04-23 | Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable form | |
CVE-2026-20045 |
Unified Communications Manager | — | 0.0454 | 2026-01-21 | 2026-02-11 | Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications | |
CVE-2024-20399 |
NX-OS | — | 0.0431 | 2024-07-02 | 2024-07-23 | Cisco NX-OS contains a command injection vulnerability in the command line inter | |
CVE-2023-20109 |
IOS and IOS XE | — | 0.0248 | 2023-10-10 | 2023-10-31 | Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group E | |
CVE-2026-76519 |
Secure Email Gateway | — | 0.0215 | 2026-10-14 | 2026-10-17 | Cisco Secure Email Gateway contains a relative path traversal vulnerability that | |
CVE-2026-20349 |
Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | 8.6 | 0.0101 | 2026-08-11 | 2026-08-14 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Thre | |
CVE-2008-4128 |
IOS | — | — | 2026-07-13 | 2026-07-16 | Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows | |
CVE-2022-20775 |
SD-WAN | — | — | 2026-02-25 | 2026-02-27 | Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an aut | |
CVE-2014-2120 |
Adaptive Security Appliance (ASA) | — | — | 2024-11-12 | 2024-12-03 | Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vu | |
CVE-2020-3259 |
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | — | — | 2024-02-15 | 2024-03-07 | RW | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) conta |
CVE-2004-1464 |
IOS | — | — | 2023-05-19 | 2023-06-09 | Cisco IOS contains an unspecified vulnerability that may block further telnet, r | |
CVE-2016-6415 |
IOS, IOS XR, and IOS XE | — | — | 2023-05-19 | 2023-06-09 | Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part | |
CVE-2017-6742 |
IOS and IOS XE Software | — | — | 2023-04-19 | 2023-05-10 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE | |
CVE-2020-3433 |
AnyConnect Secure | — | — | 2022-10-24 | 2022-11-14 | RW | Cisco AnyConnect Secure Mobility Client for Windows interprocess communication ( |
CVE-2020-3153 |
AnyConnect Secure | — | — | 2022-10-24 | 2022-11-14 | RW | Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handlin |
CVE-2019-15271 |
RV Series Routers | — | — | 2022-06-08 | 2022-06-22 | A deserialization of untrusted data vulnerability in the web-based management in | |
CVE-2016-6366 |
Adaptive Security Appliance (ASA) | — | — | 2022-05-24 | 2022-06-14 | A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) | |
CVE-2016-6367 |
Adaptive Security Appliance (ASA) | — | — | 2022-05-24 | 2022-06-14 | A vulnerability in the command-line interface (CLI) parser of Cisco ASA software | |
CVE-2022-20821 |
IOS XR | — | — | 2022-05-23 | 2022-06-13 | Cisco IOS XR software health check opens TCP port 6379 by default on activation. | |
CVE-2018-0147 |
Secure Access Control System (ACS) | — | — | 2022-03-25 | 2022-04-15 | A vulnerability in Java deserialization used by Cisco Secure Access Control Syst | |
CVE-2018-0125 |
VPN Routers | — | — | 2022-03-25 | 2022-04-15 | A vulnerability in the web interface of the Cisco VPN Routers could allow an una | |
CVE-2017-3881 |
IOS and IOS XE | — | — | 2022-03-25 | 2022-04-15 | A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code i | |
CVE-2015-0666 |
Prime Data Center Network Manager (DCNM) | — | — | 2022-03-25 | 2022-04-15 | Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Ce | |
CVE-2010-3035 |
IOS XR | — | — | 2022-03-25 | 2022-04-15 | Cisco IOS XR, when BGP is the configured routing feature, allows remote attacker | |
CVE-2009-2055 |
IOS XR | — | — | 2022-03-25 | 2022-04-15 | Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers | |
CVE-2022-20708 |
Small Business RV160, RV260, RV340, and RV345 Series Routers | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Ro | |
CVE-2022-20703 |
Small Business RV160, RV260, RV340, and RV345 Series Routers | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Ro | |
CVE-2022-20701 |
Small Business RV160, RV260, RV340, and RV345 Series Routers | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Ro | |
CVE-2022-20700 |
Small Business RV160, RV260, RV340, and RV345 Series Routers | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Ro | |
CVE-2022-20699 |
Small Business RV160, RV260, RV340, and RV345 Series Routers | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Ro | |
CVE-2019-1652 |
Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in the web-based management interface of Cisco Small Business RV | |
CVE-2018-0180 |
IOS Software | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Sof | |
CVE-2018-0179 |
IOS Software | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Sof | |
CVE-2018-0175 |
IOS, XR, and XE Software | — | — | 2022-03-03 | 2022-03-17 | Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsyste | |
CVE-2018-0174 |
IOS XE Software | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS S | |
CVE-2018-0173 |
IOS and IOS XE Software | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function tha | |
CVE-2018-0172 |
IOS and IOS XE Software | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS S | |
CVE-2018-0167 |
IOS, XR, and XE Software | — | — | 2022-03-03 | 2022-03-17 | There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (L | |
CVE-2018-0161 |
IOS Software | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Ci | |
CVE-2018-0159 |
IOS Software and Cisco IOS XE Software | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) | |
CVE-2018-0158 |
IOS Software and Cisco IOS XE Software | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) | |
CVE-2018-0156 |
IOS Software and Cisco IOS XE Software | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS | |
CVE-2018-0155 |
Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implemen | |
CVE-2018-0154 |
IOS Software | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in the crypto engine of the Cisco Integrated Services Module for | |
CVE-2018-0151 |
IOS and IOS XE Software | — | — | 2022-03-03 | 2022-03-17 | A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software | |
CVE-2017-6744 |
IOS software | — | — | 2022-03-03 | 2022-03-24 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 1 contains | |
CVE-2017-6743 |
IOS and IOS XE Software | — | — | 2022-03-03 | 2022-03-24 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE | |
CVE-2017-6740 |
IOS and IOS XE Software | — | — | 2022-03-03 | 2022-03-24 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE | |
CVE-2017-6739 |
IOS and IOS XE Software | — | — | 2022-03-03 | 2022-03-24 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE | |
CVE-2017-6738 |
IOS and IOS XE Software | — | — | 2022-03-03 | 2022-03-24 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE | |
CVE-2017-6737 |
IOS and IOS XE Software | — | — | 2022-03-03 | 2022-03-24 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE | |
CVE-2017-6736 |
IOS and IOS XE Software | — | — | 2022-03-03 | 2022-03-24 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE | |
CVE-2017-6663 |
IOS and IOS XE Software | — | — | 2022-03-03 | 2022-03-24 | A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Ci | |
CVE-2017-6627 |
IOS and IOS XE Software | — | — | 2022-03-03 | 2022-03-24 | A vulnerability in the UDP processing code of Cisco IOS and IOS XE could allow a | |
CVE-2017-12319 |
IOS XE Software | — | — | 2022-03-03 | 2022-03-24 | A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Pr | |
CVE-2017-12240 |
IOS and IOS XE Software | — | — | 2022-03-03 | 2022-03-24 | The Dynamic Host Configuration Protocol (DHCP) relay subsystem of Cisco IOS and | |
CVE-2017-12238 |
Catalyst 6800 Series Switches | — | — | 2022-03-03 | 2022-03-24 | A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS for | |
CVE-2017-12237 |
IOS and IOS XE Software | — | — | 2022-03-03 | 2022-03-24 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco I | |
CVE-2017-12235 |
IOS software | — | — | 2022-03-03 | 2022-03-24 | A vulnerability in the implementation of the PROFINET Discovery and Configuratio | |
CVE-2017-12234 |
IOS software | — | — | 2022-03-03 | 2022-03-24 | There is a vulnerability in the implementation of the Common Industrial Protocol | |
CVE-2017-12233 |
IOS software | — | — | 2022-03-03 | 2022-03-24 | There is a vulnerability in the implementation of the Common Industrial Protocol | |
CVE-2017-12232 |
IOS software | — | — | 2022-03-03 | 2022-03-24 | A vulnerability in the implementation of a protocol in Cisco Integrated Services | |
CVE-2017-12231 |
IOS software | — | — | 2022-03-03 | 2022-03-24 | A vulnerability in the implementation of Network Address Translation (NAT) funct | |
CVE-2020-3452 |
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | — | — | 2021-11-03 | 2022-05-03 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) conta | |
CVE-2020-3580 |
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | — | — | 2021-11-03 | 2022-05-03 | RW | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) conta |
CVE-2021-1497 |
HyperFlex HX | — | — | 2021-11-03 | 2021-11-17 | Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input vali | |
CVE-2021-1498 |
HyperFlex HX | — | — | 2021-11-03 | 2021-11-17 | Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input vali | |
CVE-2018-0171 |
IOS and IOS XE | — | — | 2021-11-03 | 2022-05-03 | Cisco IOS and IOS XE Software improperly validates packet data, allowing an unau | |
CVE-2020-3118 |
IOS XR | — | — | 2021-11-03 | 2022-05-03 | Cisco IOS XR improperly validates string input from certain fields in Cisco Disc | |
CVE-2020-3566 |
IOS XR | — | — | 2021-11-03 | 2022-05-03 | Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly hand | |
CVE-2020-3569 |
IOS XR | — | — | 2021-11-03 | 2022-05-03 | Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly hand | |
CVE-2020-3161 |
Cisco IP Phones | — | — | 2021-11-03 | 2022-05-03 | Cisco IP Phones contain an improper input validation vulnerability for HTTP requ | |
CVE-2019-1653 |
Small Business RV320 and RV325 Routers | — | — | 2021-11-03 | 2022-05-03 | Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improp | |
CVE-2018-0296 |
Adaptive Security Appliance (ASA) | — | — | 2021-11-03 | 2022-05-03 | Cisco Adaptive Security Appliance (ASA) contains an improper input validation vu |