All vendors
Cisco KEV entries added per year — 2021: 11, 2022: 50, 2023: 7, 2024: 6, 2025: 8, 2026: 18.
Cisco — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for Cisco with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
100 KEV entries
7 ransomware-linked
43 products
avg CVSS 8.1
last added 2026-09-30
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 100 Cisco vulnerabilities confirmed as exploited in the wild across 43 products; 7 of them (7.0%) are flagged as used in known ransomware campaigns. IOS and IOS XE Software is the most-affected product, with 14 entries (14% of the total). CISA added 18 entries in 2026 so far, compared with 8 in 2025. Across the 100 entries with an NVD CVSS score (100% of the total), the average score is 8.1; 27 entries are rated critical by NVD. The most recent addition is CVE-2026-76504 (Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability), added on 2026-09-30.
Affected products
| Product | Entries | Share |
|---|---|---|
| IOS and IOS XE Software | 14 | 14% |
| Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | 6 | 6.0% |
| IOS XR | 6 | 6.0% |
| IOS software | 6 | 6.0% |
| Catalyst SD-WAN Manager | 5 | 5.0% |
| Small Business RV160, RV260, RV340, and RV345 Series Routers | 5 | 5.0% |
| IOS and IOS XE | 4 | 4.0% |
| Adaptive Security Appliance (ASA) | 4 | 4.0% |
| IOS Software | 4 | 4.0% |
| Identity Services Engine | 3 | 3.0% |
| IOS Software and Cisco IOS XE Software | 3 | 3.0% |
| Secure Firewall Management Center (FMC) | 2 | 2.0% |
| IOS | 2 | 2.0% |
| Unified Communications Manager | 2 | 2.0% |
| Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | 2 | 2.0% |
| AnyConnect Secure | 2 | 2.0% |
| IOS, XR, and XE Software | 2 | 2.0% |
| IOS XE Software | 2 | 2.0% |
| HyperFlex HX | 2 | 2.0% |
| Secure Email Gateway | 1 | 1.0% |
| Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | 1 | 1.0% |
| Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | 1 | 1.0% |
| Catalyst SD-WAN | 1 | 1.0% |
| Catalyst SD-WAN Manger | 1 | 1.0% |
| SD-WAN | 1 | 1.0% |
| Catalyst SD-WAN Controller and Manager | 1 | 1.0% |
| Multiple Products | 1 | 1.0% |
| Smart Licensing Utility | 1 | 1.0% |
| Small Business RV Series Routers | 1 | 1.0% |
| NX-OS | 1 | 1.0% |
| Cisco IOS XE Web UI | 1 | 1.0% |
| IOS XE Web UI | 1 | 1.0% |
| Adaptive Security Appliance and Firepower Threat Defense | 1 | 1.0% |
| IOS, IOS XR, and IOS XE | 1 | 1.0% |
| RV Series Routers | 1 | 1.0% |
| Secure Access Control System (ACS) | 1 | 1.0% |
| VPN Routers | 1 | 1.0% |
| Prime Data Center Network Manager (DCNM) | 1 | 1.0% |
| Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers | 1 | 1.0% |
| Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches | 1 | 1.0% |
| Catalyst 6800 Series Switches | 1 | 1.0% |
| Cisco IP Phones | 1 | 1.0% |
| Small Business RV320 and RV325 Routers | 1 | 1.0% |
Entries added per year
By date added to the KEV catalog
Exploited Cisco vulnerabilities (100)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2026-76504 | Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | 2026-09-30 | — | CRITICAL9.8 |
| CVE-2026-76460 | Identity Services Engine | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | 2026-09-16 | — | CRITICAL10.0 |
| CVE-2026-76461 | Secure Email Gateway | Cisco Secure Email Gateway SQL Injection Vulnerability | 2026-09-14 | — | CRITICAL9.8 |
| CVE-2026-20079 | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-09-09 | — | CRITICAL10.0 |
| CVE-2026-20349 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability | 2026-08-11 | — | HIGH8.6 |
| CVE-2026-20316 | Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability | 2026-07-29 | Known | MEDIUM5.3 |
| CVE-2008-4128 | IOS | Cisco IOS Cross-Site Request Forgery Vulnerability | 2026-07-13 | — | HIGH8.1 |
| CVE-2026-20230 | Unified Communications Manager | Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability | 2026-06-25 | — | HIGH8.6 |
| CVE-2026-20262 | Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability | 2026-06-15 | — | MEDIUM6.5 |
| CVE-2026-20245 | Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability | 2026-06-09 | — | HIGH7.8 |
| CVE-2026-20182 | Catalyst SD-WAN | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability | 2026-05-14 | — | CRITICAL10.0 |
| CVE-2026-20122 | Catalyst SD-WAN Manger | Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability | 2026-04-20 | — | MEDIUM5.4 |
| CVE-2026-20133 | Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | 2026-04-20 | — | MEDIUM6.5 |
| CVE-2026-20128 | Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability | 2026-04-20 | — | HIGH7.5 |
| CVE-2026-20131 | Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability | 2026-03-19 | Known | CRITICAL10.0 |
| CVE-2022-20775 | SD-WAN | Cisco SD-WAN Path Traversal Vulnerability | 2026-02-25 | — | HIGH7.8 |
| CVE-2026-20127 | Catalyst SD-WAN Controller and Manager | Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability | 2026-02-25 | — | CRITICAL10.0 |
| CVE-2026-20045 | Unified Communications Manager | Cisco Unified Communications Products Code Injection Vulnerability | 2026-01-21 | — | HIGH8.2 |
| CVE-2025-20393 | Multiple Products | Cisco Multiple Products Improper Input Validation Vulnerability | 2025-12-17 | — | CRITICAL10.0 |
| CVE-2025-20352 | IOS and IOS XE | Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability | 2025-09-29 | — | HIGH7.7 |
| CVE-2025-20362 | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability | 2025-09-25 | — | MEDIUM6.5 |
| CVE-2025-20333 | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability | 2025-09-25 | — | CRITICAL9.9 |
| CVE-2025-20337 | Identity Services Engine | Cisco Identity Services Engine Injection Vulnerability | 2025-07-28 | — | CRITICAL10.0 |
| CVE-2025-20281 | Identity Services Engine | Cisco Identity Services Engine Injection Vulnerability | 2025-07-28 | — | CRITICAL10.0 |
| CVE-2024-20439 | Smart Licensing Utility | Cisco Smart Licensing Utility Static Credential Vulnerability | 2025-03-31 | — | CRITICAL9.8 |
| CVE-2023-20118 | Small Business RV Series Routers | Cisco Small Business RV Series Routers Command Injection Vulnerability | 2025-03-03 | — | MEDIUM6.5 |
| CVE-2014-2120 | Adaptive Security Appliance (ASA) | Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability | 2024-11-12 | — | MEDIUM6.1 |
| CVE-2024-20481 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Denial-of-Service Vulnerability | 2024-10-24 | — | MEDIUM5.8 |
| CVE-2024-20399 | NX-OS | Cisco NX-OS Command Injection Vulnerability | 2024-07-02 | — | MEDIUM6.0 |
| CVE-2024-20359 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Privilege Escalation Vulnerability | 2024-04-24 | — | MEDIUM6.0 |
| CVE-2024-20353 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Denial of Service Vulnerability | 2024-04-24 | — | HIGH8.6 |
| CVE-2020-3259 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Information Disclosure Vulnerability | 2024-02-15 | Known | HIGH7.5 |
| CVE-2023-20273 | Cisco IOS XE Web UI | Cisco IOS XE Web UI Command Injection Vulnerability | 2023-10-23 | — | HIGH7.2 |
| CVE-2023-20198 | IOS XE Web UI | Cisco IOS XE Web UI Privilege Escalation Vulnerability | 2023-10-16 | — | CRITICAL10.0 |
| CVE-2023-20109 | IOS and IOS XE | Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability | 2023-10-10 | — | MEDIUM6.6 |
| CVE-2023-20269 | Adaptive Security Appliance and Firepower Threat Defense | Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability | 2023-09-13 | Known | MEDIUM5.0 |
| CVE-2004-1464 | IOS | Cisco IOS Denial-of-Service Vulnerability | 2023-05-19 | — | MEDIUM5.9 |
| CVE-2016-6415 | IOS, IOS XR, and IOS XE | Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability | 2023-05-19 | — | HIGH7.5 |
| CVE-2017-6742 | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2023-04-19 | — | HIGH8.8 |
| CVE-2020-3433 | AnyConnect Secure | Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability | 2022-10-24 | Known | HIGH7.8 |
| CVE-2020-3153 | AnyConnect Secure | Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability | 2022-10-24 | Known | MEDIUM6.5 |
| CVE-2019-15271 | RV Series Routers | Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability | 2022-06-08 | — | HIGH8.8 |
| CVE-2016-6366 | Adaptive Security Appliance (ASA) | Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability | 2022-05-24 | — | HIGH8.8 |
| CVE-2016-6367 | Adaptive Security Appliance (ASA) | Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability | 2022-05-24 | — | HIGH7.8 |
| CVE-2022-20821 | IOS XR | Cisco IOS XR Open Port Vulnerability | 2022-05-23 | — | MEDIUM6.5 |
| CVE-2018-0147 | Secure Access Control System (ACS) | Cisco Secure Access Control System Java Deserialization Vulnerability | 2022-03-25 | — | CRITICAL9.8 |
| CVE-2018-0125 | VPN Routers | Cisco VPN Routers Remote Code Execution Vulnerability | 2022-03-25 | — | CRITICAL9.8 |
| CVE-2017-3881 | IOS and IOS XE | Cisco IOS and IOS XE Remote Code Execution Vulnerability | 2022-03-25 | — | CRITICAL9.8 |
| CVE-2015-0666 | Prime Data Center Network Manager (DCNM) | Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability | 2022-03-25 | — | HIGH7.5 |
| CVE-2010-3035 | IOS XR | Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability | 2022-03-25 | — | HIGH7.5 |
| CVE-2009-2055 | IOS XR | Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability | 2022-03-25 | — | MEDIUM5.9 |
| CVE-2022-20708 | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | — | CRITICAL10.0 |
| CVE-2022-20703 | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | — | CRITICAL10.0 |
| CVE-2022-20701 | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | — | CRITICAL10.0 |
| CVE-2022-20700 | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | — | CRITICAL10.0 |
| CVE-2022-20699 | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | — | CRITICAL10.0 |
| CVE-2019-1652 | Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers | Cisco Small Business Routers Improper Input Validation Vulnerability | 2022-03-03 | — | HIGH7.2 |
| CVE-2018-0180 | IOS Software | Cisco IOS Software Denial-of-Service Vulnerability | 2022-03-03 | — | MEDIUM5.9 |
| CVE-2018-0179 | IOS Software | Cisco IOS Software Denial-of-Service Vulnerability | 2022-03-03 | — | MEDIUM5.9 |
| CVE-2018-0175 | IOS, XR, and XE Software | Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability | 2022-03-03 | — | HIGH8.0 |
| CVE-2018-0174 | IOS XE Software | Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability | 2022-03-03 | — | HIGH8.6 |
| CVE-2018-0173 | IOS and IOS XE Software | Cisco IOS and IOS XE Software Improper Input Validation Vulnerability | 2022-03-03 | — | HIGH8.6 |
| CVE-2018-0172 | IOS and IOS XE Software | Cisco IOS and IOS XE Software Improper Input Validation Vulnerability | 2022-03-03 | — | HIGH8.6 |
| CVE-2018-0167 | IOS, XR, and XE Software | Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability | 2022-03-03 | — | HIGH8.8 |
| CVE-2018-0161 | IOS Software | Cisco IOS Software Resource Management Errors Vulnerability | 2022-03-03 | — | MEDIUM6.3 |
| CVE-2018-0159 | IOS Software and Cisco IOS XE Software | Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability | 2022-03-03 | — | HIGH7.5 |
| CVE-2018-0158 | IOS Software and Cisco IOS XE Software | Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability | 2022-03-03 | — | HIGH8.6 |
| CVE-2018-0156 | IOS Software and Cisco IOS XE Software | Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability | 2022-03-03 | — | HIGH7.5 |
| CVE-2018-0155 | Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches | Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability | 2022-03-03 | — | HIGH8.6 |
| CVE-2018-0154 | IOS Software | Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability | 2022-03-03 | — | HIGH7.5 |
| CVE-2018-0151 | IOS and IOS XE Software | Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability | 2022-03-03 | — | CRITICAL9.8 |
| CVE-2017-6744 | IOS software | Cisco IOS Software SNMP Remote Code Execution Vulnerability | 2022-03-03 | — | HIGH8.8 |
| CVE-2017-6743 | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2022-03-03 | — | HIGH8.8 |
| CVE-2017-6740 | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2022-03-03 | — | HIGH8.8 |
| CVE-2017-6739 | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2022-03-03 | — | HIGH8.8 |
| CVE-2017-6738 | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2022-03-03 | — | HIGH8.8 |
| CVE-2017-6737 | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2022-03-03 | — | HIGH8.8 |
| CVE-2017-6736 | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2022-03-03 | — | HIGH8.8 |
| CVE-2017-6663 | IOS and IOS XE Software | Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability | 2022-03-03 | — | MEDIUM6.5 |
| CVE-2017-6627 | IOS and IOS XE Software | Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability | 2022-03-03 | — | HIGH7.5 |
| CVE-2017-12319 | IOS XE Software | Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability | 2022-03-03 | — | MEDIUM5.9 |
| CVE-2017-12240 | IOS and IOS XE Software | Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability | 2022-03-03 | — | CRITICAL9.8 |
| CVE-2017-12238 | Catalyst 6800 Series Switches | Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability | 2022-03-03 | — | MEDIUM6.5 |
| CVE-2017-12237 | IOS and IOS XE Software | Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability | 2022-03-03 | — | HIGH7.5 |
| CVE-2017-12235 | IOS software | Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability | 2022-03-03 | — | HIGH7.5 |
| CVE-2017-12234 | IOS software | Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability | 2022-03-03 | — | HIGH7.5 |
| CVE-2017-12233 | IOS software | Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability | 2022-03-03 | — | HIGH7.5 |
| CVE-2017-12232 | IOS software | Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability | 2022-03-03 | — | MEDIUM6.5 |
| CVE-2017-12231 | IOS software | Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability | 2022-03-03 | — | HIGH7.5 |
| CVE-2020-3452 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Read-Only Path Traversal Vulnerability | 2021-11-03 | — | HIGH7.5 |
| CVE-2020-3580 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability | 2021-11-03 | Known | MEDIUM6.1 |
| CVE-2021-1497 | HyperFlex HX | Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability | 2021-11-03 | — | CRITICAL9.8 |
| CVE-2021-1498 | HyperFlex HX | Cisco HyperFlex HX Data Platform Command Injection Vulnerability | 2021-11-03 | — | CRITICAL9.8 |
| CVE-2018-0171 | IOS and IOS XE | Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability | 2021-11-03 | — | CRITICAL9.8 |
| CVE-2020-3118 | IOS XR | Cisco IOS XR Software Discovery Protocol Format String Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2020-3566 | IOS XR | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | 2021-11-03 | — | HIGH8.6 |
| CVE-2020-3569 | IOS XR | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | 2021-11-03 | — | HIGH8.6 |
| CVE-2020-3161 | Cisco IP Phones | Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability | 2021-11-03 | — | CRITICAL9.8 |
| CVE-2019-1653 | Small Business RV320 and RV325 Routers | Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability | 2021-11-03 | — | HIGH7.5 |
| CVE-2018-0296 | Adaptive Security Appliance (ASA) | Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability | 2021-11-03 | — | HIGH7.5 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.