Cisco: exploited vulnerabilities
- 101exploited vulnerabilities
- 7used by ransomware
- Oct 14, 2026latest one added
- IOS and IOS XE Software 14
- Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) 6
- IOS XR 6
- IOS software 6
- Catalyst SD-WAN Manager 5
- Small Business RV160, RV260, RV340, and RV345 Series Routers 5
- IOS and IOS XE 4
- Adaptive Security Appliance (ASA) 4
- IOS Software 4
- Identity Services Engine 3
- IOS Software and Cisco IOS XE Software 3
- Secure Email Gateway 2
- Secure Firewall Management Center (FMC) 2
- IOS 2
- Unified Communications Manager 2
- Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense 2
- AnyConnect Secure 2
- IOS, XR, and XE Software 2
- IOS XE Software 2
- HyperFlex HX 2
- Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management 1
- Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) 1
- Catalyst SD-WAN 1
- Catalyst SD-WAN Manger 1
- Catalyst SD-WAN Controller and Manager 1
- SD-WAN 1
- Multiple Products 1
- Smart Licensing Utility 1
- Small Business RV Series Routers 1
- NX-OS 1
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 14, 2026 | Relative Path Traversal | Secure Email Gateway | Critical 9.8 | 2.2% |
| Sep 30, 2026 | Hex Encoding | Catalyst SD-WAN Manager | Critical 9.8 | 39% |
| Sep 16, 2026 | Incorrect Use of Privileged APIs | Identity Services Engine | Critical 10.0 | 76% |
| Sep 14, 2026 | SQL Injection | Secure Email Gateway | Critical 9.8 | 30% |
| Sep 9, 2026 | Firewall Management Center Authentication Bypass Using an Alternate Path or Channel | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Critical 10.0 | 88% |
| Aug 11, 2026 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | High 8.6 | 1.0% |
| Jul 29, 2026 | Secure Firewall Management Center Use of Hard-coded Password | Secure Firewall Management Center (FMC) | Medium 5.3 | 35% |
| Jul 13, 2026 | Cross-Site Request Forgery | IOS | High 8.1 | 34% |
| Jun 25, 2026 | Server-Side Request Forgery (SSRF) | Unified Communications Manager | High 8.6 | 88% |
| Jun 15, 2026 | Directory or Path Traversal | Catalyst SD-WAN Manager | Medium 6.5 | 29% |
| Jun 9, 2026 | Improper Encoding or Escaping of Output | Catalyst SD-WAN Manager | High 7.8 | 25% |
| May 14, 2026 | Controller Authentication Bypass | Catalyst SD-WAN | Critical 10.0 | 92% |
| Apr 20, 2026 | Exposure of Sensitive Information to an Unauthorized Actor | Catalyst SD-WAN Manager | Medium 6.5 | 31% |
| Apr 20, 2026 | Storing Passwords in a Recoverable Format | Catalyst SD-WAN Manager | High 7.5 | 7.3% |
| Apr 20, 2026 | Catalyst SD-WAN Manager Incorrect Use of Privileged APIs | Catalyst SD-WAN Manger | Medium 5.4 | 26% |
| Mar 19, 2026 | Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data | Secure Firewall Management Center (FMC) | Critical 10.0 | 43% |
| Feb 25, 2026 | Authentication Bypass | Catalyst SD-WAN Controller and Manager | Critical 10.0 | 89% |
| Feb 25, 2026 | Path Traversal | SD-WAN | High 7.8 | 12% |
| Jan 21, 2026 | Unified Communications Products Code Injection | Unified Communications Manager | High 8.2 | 4.5% |
| Dec 17, 2025 | Improper Input Validation | Multiple Products | Critical 10.0 | 32% |
| Sep 29, 2025 | Software SNMP Denial of Service and Remote Code Execution | IOS and IOS XE | High 7.7 | 42% |
| Sep 25, 2025 | Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | Medium 6.5 | 87% |
| Sep 25, 2025 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | Critical 9.9 | 71% |
| Jul 28, 2025 | Injection | Identity Services Engine | Critical 10.0 | 74% |
| Jul 28, 2025 | Injection | Identity Services Engine | Critical 10.0 | 98% |
| Mar 31, 2025 | Static Credential | Smart Licensing Utility | Critical 9.8 | 97% |
| Mar 3, 2025 | Command Injection | Small Business RV Series Routers | Medium 6.5 | 54% |
| Nov 12, 2024 | Cross-Site Scripting (XSS) | Adaptive Security Appliance (ASA) | Medium 5.4 | 23% |
| Oct 24, 2024 | ASA and FTD Denial-of-Service | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Medium 5.8 | 16% |
| Jul 2, 2024 | Command Injection | NX-OS | Medium 6.0 | 4.3% |
| Apr 24, 2024 | ASA and FTD Privilege Escalation | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Medium 6.0 | 19% |
| Apr 24, 2024 | ASA and FTD Denial of Service | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | High 8.6 | 70% |
| Feb 15, 2024 | ASA and FTD Information Disclosure | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | High 7.5 | 72% |
| Oct 23, 2023 | IOS XE Web UI Command Injection | Cisco IOS XE Web UI | High 7.2 | 93% |
| Oct 16, 2023 | Privilege Escalation | IOS XE Web UI | Critical 10.0 | 99.6% |
| Oct 10, 2023 | Group Encrypted Transport VPN Out-of-Bounds Write | IOS and IOS XE | Medium 6.6 | 2.5% |
| Sep 13, 2023 | Unauthorized Access | Adaptive Security Appliance and Firepower Threat Defense | Medium 5.0 | 27% |
| May 19, 2023 | IKEv1 Information Disclosure | IOS, IOS XR, and IOS XE | High 7.5 | 88% |
| May 19, 2023 | Denial-of-Service | IOS | Medium 5.9 | 4.8% |
| Apr 19, 2023 | SNMP Remote Code Execution | IOS and IOS XE Software | High 8.8 | 21% |
| Oct 24, 2022 | Mobility Client for Windows DLL Hijacking | AnyConnect Secure | High 7.8 | 10% |
| Oct 24, 2022 | Mobility Client for Windows Uncontrolled Search Path | AnyConnect Secure | Medium 6.5 | 28% |
| Jun 8, 2022 | Deserialization of Untrusted Data | RV Series Routers | High 8.8 | 5.5% |
| May 24, 2022 | CLI Remote Code Execution | Adaptive Security Appliance (ASA) | High 7.8 | 23% |
| May 24, 2022 | SNMP Buffer Overflow | Adaptive Security Appliance (ASA) | High 8.8 | 88% |
| May 23, 2022 | Open Port | IOS XR | Medium 6.5 | 11% |
| Mar 25, 2022 | Secure Access Control System Java Deserialization | Secure Access Control System (ACS) | Critical 9.8 | 18% |
| Mar 25, 2022 | Remote Code Execution | VPN Routers | Critical 9.8 | 55% |
| Mar 25, 2022 | Remote Code Execution | IOS and IOS XE | Critical 9.8 | 99% |
| Mar 25, 2022 | Directory Traversal | Prime Data Center Network Manager (DCNM) | High 7.5 | 40% |
| Mar 25, 2022 | Border Gateway Protocol (BGP) Denial-of-Service | IOS XR | High 7.5 | 5.7% |
| Mar 25, 2022 | Border Gateway Protocol (BGP) Denial-of-Service | IOS XR | Medium 5.9 | 3.3% |
| Mar 3, 2022 | Small Business RV Series Routers Stack-based Buffer Overflow | Small Business RV160, RV260, RV340, and RV345 Series Routers | Critical 10.0 | 15% |
| Mar 3, 2022 | Small Business RV Series Routers Stack-based Buffer Overflow | Small Business RV160, RV260, RV340, and RV345 Series Routers | Critical 10.0 | 9.2% |
| Mar 3, 2022 | Small Business RV Series Routers Stack-based Buffer Overflow | Small Business RV160, RV260, RV340, and RV345 Series Routers | Critical 10.0 | 9.7% |
| Mar 3, 2022 | Small Business RV Series Routers Stack-based Buffer Overflow | Small Business RV160, RV260, RV340, and RV345 Series Routers | Critical 10.0 | 5.7% |
| Mar 3, 2022 | Small Business RV Series Routers Stack-based Buffer Overflow | Small Business RV160, RV260, RV340, and RV345 Series Routers | Critical 10.0 | 72% |
| Mar 3, 2022 | Small Business Routers Improper Input Validation | Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers | High 7.2 | 96% |
| Mar 3, 2022 | Denial-of-Service | IOS Software | Medium 6.8 | 4.9% |
| Mar 3, 2022 | Denial-of-Service | IOS Software | Medium 6.8 | 4.9% |
| Mar 3, 2022 | Buffer Overflow | IOS, XR, and XE Software | High 8.0 | 3.5% |
| Mar 3, 2022 | IOS Software and Cisco IOS XE Software Improper Input Validation | IOS XE Software | High 8.6 | 7.6% |
| Mar 3, 2022 | Improper Input Validation | IOS and IOS XE Software | High 8.6 | 7.6% |
| Mar 3, 2022 | Improper Input Validation | IOS and IOS XE Software | High 8.6 | 7.8% |
| Mar 3, 2022 | Buffer Overflow | IOS, XR, and XE Software | High 8.8 | 3.4% |
| Mar 3, 2022 | Resource Management Errors | IOS Software | Medium 6.3 | 4.1% |
| Mar 3, 2022 | IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service | IOS Software and Cisco IOS XE Software | High 7.5 | 6.9% |
| Mar 3, 2022 | IOS and XE Software Internet Key Exchange Memory Leak | IOS Software and Cisco IOS XE Software | High 8.6 | 7.2% |
| Mar 3, 2022 | Smart Install Denial-of-Service | IOS Software and Cisco IOS XE Software | High 7.5 | 9.4% |
| Mar 3, 2022 | Catalyst Bidirectional Forwarding Detection Denial-of-Service | Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches | High 8.6 | 7.7% |
| Mar 3, 2022 | Integrated Services Module for VPN Denial-of-Service | IOS Software | High 7.5 | 7.1% |
| Mar 3, 2022 | IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution | IOS and IOS XE Software | Critical 9.8 | 14% |
| Mar 3, 2022 | SNMP Remote Code Execution | IOS software | High 8.8 | 7.3% |
| Mar 3, 2022 | SNMP Remote Code Execution | IOS and IOS XE Software | High 8.8 | 11% |
| Mar 3, 2022 | SNMP Remote Code Execution | IOS and IOS XE Software | High 8.8 | 11% |
| Mar 3, 2022 | SNMP Remote Code Execution | IOS and IOS XE Software | High 8.8 | 11% |
| Mar 3, 2022 | SNMP Remote Code Execution | IOS and IOS XE Software | High 8.8 | 11% |
| Mar 3, 2022 | SNMP Remote Code Execution | IOS and IOS XE Software | High 8.8 | 45% |
| Mar 3, 2022 | SNMP Remote Code Execution | IOS and IOS XE Software | High 8.8 | 70% |
| Mar 3, 2022 | IOS Software and Cisco IOS XE Software Denial-of-Service | IOS and IOS XE Software | Medium 6.5 | 2.1% |
| Mar 3, 2022 | IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service | IOS and IOS XE Software | High 7.5 | 6.2% |
| Mar 3, 2022 | Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service | IOS XE Software | Medium 5.9 | 5.2% |
| Mar 3, 2022 | DHCP Remote Code Execution | IOS and IOS XE Software | Critical 9.8 | 14% |
| Mar 3, 2022 | VPLS Denial-of-Service | Catalyst 6800 Series Switches | Medium 6.5 | 2.0% |
| Mar 3, 2022 | Internet Key Exchange Denial-of-Service | IOS and IOS XE Software | High 7.5 | 7.1% |
| Mar 3, 2022 | for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service | IOS software | High 7.5 | 7.1% |
| Mar 3, 2022 | Common Industrial Protocol Request Denial-of-Service | IOS software | High 7.5 | 7.1% |
| Mar 3, 2022 | Common Industrial Protocol Request Denial-of-Service | IOS software | High 7.5 | 7.1% |
| Mar 3, 2022 | for Cisco Integrated Services Routers Denial-of-Service | IOS software | Medium 6.5 | 2.2% |
| Mar 3, 2022 | Network Address Translation Denial-of-Service | IOS software | High 7.5 | 7.1% |
| Nov 3, 2021 | Data Platform Command Injection | HyperFlex HX | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Installer Virtual Machine Command Injection | HyperFlex HX | Critical 9.8 | 99.9% |
| Nov 3, 2021 | ASA and FTD Cross-Site Scripting (XSS) | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Medium 6.1 | 86% |
| Nov 3, 2021 | Software DVMRP Memory Exhaustion | IOS XR | High 8.6 | 3.3% |
| Nov 3, 2021 | Software DVMRP Memory Exhaustion | IOS XR | High 8.6 | 3.7% |
| Nov 3, 2021 | ASA and FTD Read-Only Path Traversal | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | High 7.5 | >99.9% |
| Nov 3, 2021 | IP Phones Web Server Remote Code Execution and Denial-of-Service | Cisco IP Phones | Critical 9.8 | 84% |
| Nov 3, 2021 | Software Discovery Protocol Format String | IOS XR | High 8.8 | 12% |
| Nov 3, 2021 | Information Disclosure | Small Business RV320 and RV325 Routers | High 7.5 | 99.9% |
| Nov 3, 2021 | Denial-of-Service | Adaptive Security Appliance (ASA) | High 7.5 | 99.9% |
| Nov 3, 2021 | Software Smart Install Remote Code Execution | IOS and IOS XE | High 7.5 | 99.5% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.