Cisco: actively exploited vulnerabilities

Affected products

• IOS and IOS XE Software14
• Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)6
• IOS software6
• IOS XR6
• Catalyst SD-WAN Manager5
• Small Business RV160, RV260, RV340, and RV345 Series Routers5
• Adaptive Security Appliance (ASA)4
• IOS and IOS XE4
• IOS Software4
• Identity Services Engine3
• IOS Software and Cisco IOS XE Software3
• AnyConnect Secure2
• HyperFlex HX2
• IOS2
• IOS XE Software2
• IOS, XR, and XE Software2
• Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense2
• Secure Firewall Management Center (FMC)2
• Unified Communications Manager2
• Adaptive Security Appliance and Firepower Threat Defense1
• Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches1
• Catalyst 6800 Series Switches1
• Catalyst SD-WAN1
• Catalyst SD-WAN Controller and Manager1
• Catalyst SD-WAN Manger1
• Cisco IOS XE Web UI1
• Cisco IP Phones1
• IOS XE Web UI1
• IOS, IOS XR, and IOS XE1
• Multiple Products1
• NX-OS1
• Prime Data Center Network Manager (DCNM)1
• RV Series Routers1
• SD-WAN1
• Secure Access Control System (ACS)1
• Secure Email Gateway1
• Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)1
• Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management1
• Small Business RV Series Routers1
• Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers1
• Small Business RV320 and RV325 Routers1
• Smart Licensing Utility1
• VPN Routers1

CERT-FR alerts and notices

Recent CERT-FR publications naming this vendor (alerts: immediate threat; notices: patches released). In French.

1. CERTFR-2026-AVI-1282Oct 8

   Multiples vulnérabilités dans les produits Cisco (08 octobre 2026)

2. CERTFR-2026-ALE-002Feb 25

   [MàJ] Vulnérabilité dans Cisco Catalyst SD-WAN (25 février 2026)

3. CERTFR-2025-ALE-013Sep 25 2025

   [MàJ] Multiples vulnérabilités dans Cisco ASA et FTD (25 septembre 2025)

4. CERTFR-2024-ALE-007Apr 25 2024

   Multiples vulnérabilités dans les produits Cisco (25 avril 2024)

All exploited vulnerabilities

CISA KEV catalog, newest first: each entry corresponds to observed exploitation.

2026 18 vulnerabilities

1. CVE-2026-76504added Sep 30

   Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

   NVD entryCISA catalog

2. CVE-2026-76460added Sep 16

   Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

   NVD entryCISA catalog

3. CVE-2026-76461added Sep 14

   Cisco Secure Email Gateway SQL Injection Vulnerability

   NVD entryCISA catalog

4. CVE-2026-20079added Sep 9

   Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

   NVD entryCISA catalog

5. CVE-2026-20349added Aug 11

   Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

   NVD entryCISA catalog

6. CVE-2026-20316Used by ransomwareadded Jul 29

   Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

   NVD entryCISA catalog

7. CVE-2008-4128added Jul 13

   Cisco IOS Cross-Site Request Forgery Vulnerability

   NVD entryCISA catalog

8. CVE-2026-20230added Jun 25

   Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

   NVD entryCISA catalog

9. CVE-2026-20262added Jun 15

   Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

   NVD entryCISA catalog

10. CVE-2026-20245added Jun 9

    Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

    NVD entryCISA catalog

11. CVE-2026-20182added May 14

    Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

    NVD entryCISA catalog

12. CVE-2026-20133added Apr 20

    Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

    NVD entryCISA catalog

13. CVE-2026-20128added Apr 20

    Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

    NVD entryCISA catalog

14. CVE-2026-20122added Apr 20

    Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

    NVD entryCISA catalog

15. CVE-2026-20131Used by ransomwareadded Mar 19

    Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

    NVD entryCISA catalog

16. CVE-2026-20127added Feb 25

    Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

    NVD entryCISA catalog

17. CVE-2022-20775added Feb 25

    Cisco SD-WAN Path Traversal Vulnerability

    NVD entryCISA catalog

18. CVE-2026-20045added Jan 21

    Cisco Unified Communications Products Code Injection Vulnerability

    NVD entryCISA catalog

2025 8 vulnerabilities

1. CVE-2025-20393added Dec 17 2025

   Cisco Multiple Products Improper Input Validation Vulnerability

   NVD entryCISA catalog

2. CVE-2025-20352added Sep 29 2025

   Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

   NVD entryCISA catalog

3. CVE-2025-20362added Sep 25 2025

   Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

   NVD entryCISA catalog

4. CVE-2025-20333added Sep 25 2025

   Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

   NVD entryCISA catalog

5. CVE-2025-20337added Jul 28 2025

   Cisco Identity Services Engine Injection Vulnerability

   NVD entryCISA catalog

6. CVE-2025-20281added Jul 28 2025

   Cisco Identity Services Engine Injection Vulnerability

   NVD entryCISA catalog

7. CVE-2024-20439added Mar 31 2025

   Cisco Smart Licensing Utility Static Credential Vulnerability

   NVD entryCISA catalog

8. CVE-2023-20118added Mar 3 2025

   Cisco Small Business RV Series Routers Command Injection Vulnerability

   NVD entryCISA catalog

2024 6 vulnerabilities

1. CVE-2014-2120added Nov 12 2024

   Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability

   NVD entryCISA catalog

2. CVE-2024-20481added Oct 24 2024

   Cisco ASA and FTD Denial-of-Service Vulnerability

   NVD entryCISA catalog

3. CVE-2024-20399added Jul 2 2024

   Cisco NX-OS Command Injection Vulnerability

   NVD entryCISA catalog

4. CVE-2024-20359added Apr 24 2024

   Cisco ASA and FTD Privilege Escalation Vulnerability

   NVD entryCISA catalog

5. CVE-2024-20353added Apr 24 2024

   Cisco ASA and FTD Denial of Service Vulnerability

   NVD entryCISA catalog

6. CVE-2020-3259Used by ransomwareadded Feb 15 2024

   Cisco ASA and FTD Information Disclosure Vulnerability

   NVD entryCISA catalog

2023 7 vulnerabilities

1. CVE-2023-20273added Oct 23 2023

   Cisco IOS XE Web UI Command Injection Vulnerability

   NVD entryCISA catalog

2. CVE-2023-20198added Oct 16 2023

   Cisco IOS XE Web UI Privilege Escalation Vulnerability

   NVD entryCISA catalog

3. CVE-2023-20109added Oct 10 2023

   Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability

   NVD entryCISA catalog

4. CVE-2023-20269Used by ransomwareadded Sep 13 2023

   Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability

   NVD entryCISA catalog

5. CVE-2016-6415added May 19 2023

   Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability

   NVD entryCISA catalog

6. CVE-2004-1464added May 19 2023

   Cisco IOS Denial-of-Service Vulnerability

   NVD entryCISA catalog

7. CVE-2017-6742added Apr 19 2023

   Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

   NVD entryCISA catalog

2022 50 vulnerabilities

1. CVE-2020-3433Used by ransomwareadded Oct 24 2022

   Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability

   NVD entryCISA catalog

2. CVE-2020-3153Used by ransomwareadded Oct 24 2022

   Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

   NVD entryCISA catalog

3. CVE-2019-15271added Jun 8 2022

   Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability

   NVD entryCISA catalog

4. CVE-2016-6367added May 24 2022

   Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability

   NVD entryCISA catalog

5. CVE-2016-6366added May 24 2022

   Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability

   NVD entryCISA catalog

6. CVE-2022-20821added May 23 2022

   Cisco IOS XR Open Port Vulnerability

   NVD entryCISA catalog

7. CVE-2018-0147added Mar 25 2022

   Cisco Secure Access Control System Java Deserialization Vulnerability

   NVD entryCISA catalog

8. CVE-2018-0125added Mar 25 2022

   Cisco VPN Routers Remote Code Execution Vulnerability

   NVD entryCISA catalog

9. CVE-2017-3881added Mar 25 2022

   Cisco IOS and IOS XE Remote Code Execution Vulnerability

   NVD entryCISA catalog

10. CVE-2015-0666added Mar 25 2022

    Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability

    NVD entryCISA catalog

11. CVE-2010-3035added Mar 25 2022

    Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

    NVD entryCISA catalog

12. CVE-2009-2055added Mar 25 2022

    Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

    NVD entryCISA catalog

13. CVE-2022-20708added Mar 3 2022

    Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

    NVD entryCISA catalog

14. CVE-2022-20703added Mar 3 2022

    Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

    NVD entryCISA catalog

15. CVE-2022-20701added Mar 3 2022

    Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

    NVD entryCISA catalog

16. CVE-2022-20700added Mar 3 2022

    Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

    NVD entryCISA catalog

17. CVE-2022-20699added Mar 3 2022

    Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

    NVD entryCISA catalog

18. CVE-2019-1652added Mar 3 2022

    Cisco Small Business Routers Improper Input Validation Vulnerability

    NVD entryCISA catalog

19. CVE-2018-0180added Mar 3 2022

    Cisco IOS Software Denial-of-Service Vulnerability

    NVD entryCISA catalog

20. CVE-2018-0179added Mar 3 2022

    Cisco IOS Software Denial-of-Service Vulnerability

    NVD entryCISA catalog

21. CVE-2018-0175added Mar 3 2022

    Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability

    NVD entryCISA catalog

22. CVE-2018-0174added Mar 3 2022

    Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability

    NVD entryCISA catalog

23. CVE-2018-0173added Mar 3 2022

    Cisco IOS and IOS XE Software Improper Input Validation Vulnerability

    NVD entryCISA catalog

24. CVE-2018-0172added Mar 3 2022

    Cisco IOS and IOS XE Software Improper Input Validation Vulnerability

    NVD entryCISA catalog

25. CVE-2018-0167added Mar 3 2022

    Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability

    NVD entryCISA catalog

26. CVE-2018-0161added Mar 3 2022

    Cisco IOS Software Resource Management Errors Vulnerability

    NVD entryCISA catalog

27. CVE-2018-0159added Mar 3 2022

    Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability

    NVD entryCISA catalog

28. CVE-2018-0158added Mar 3 2022

    Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability

    NVD entryCISA catalog

29. CVE-2018-0156added Mar 3 2022

    Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability

    NVD entryCISA catalog

30. CVE-2018-0155added Mar 3 2022

    Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability

    NVD entryCISA catalog

31. CVE-2018-0154added Mar 3 2022

    Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability

    NVD entryCISA catalog

32. CVE-2018-0151added Mar 3 2022

    Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability

    NVD entryCISA catalog

33. CVE-2017-6744added Mar 3 2022

    Cisco IOS Software SNMP Remote Code Execution Vulnerability

    NVD entryCISA catalog

34. CVE-2017-6743added Mar 3 2022

    Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

    NVD entryCISA catalog

35. CVE-2017-6740added Mar 3 2022

    Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

    NVD entryCISA catalog

36. CVE-2017-6739added Mar 3 2022

    Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

    NVD entryCISA catalog

37. CVE-2017-6738added Mar 3 2022

    Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

    NVD entryCISA catalog

38. CVE-2017-6737added Mar 3 2022

    Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

    NVD entryCISA catalog

39. CVE-2017-6736added Mar 3 2022

    Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

    NVD entryCISA catalog

40. CVE-2017-6663added Mar 3 2022

    Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability

    NVD entryCISA catalog

41. CVE-2017-6627added Mar 3 2022

    Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability

    NVD entryCISA catalog

42. CVE-2017-12319added Mar 3 2022

    Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability

    NVD entryCISA catalog

43. CVE-2017-12240added Mar 3 2022

    Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability

    NVD entryCISA catalog

44. CVE-2017-12238added Mar 3 2022

    Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability

    NVD entryCISA catalog

45. CVE-2017-12237added Mar 3 2022

    Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability

    NVD entryCISA catalog

46. CVE-2017-12235added Mar 3 2022

    Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability

    NVD entryCISA catalog

47. CVE-2017-12234added Mar 3 2022

    Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability

    NVD entryCISA catalog

48. CVE-2017-12233added Mar 3 2022

    Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability

    NVD entryCISA catalog

49. CVE-2017-12232added Mar 3 2022

    Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability

    NVD entryCISA catalog

50. CVE-2017-12231added Mar 3 2022

    Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability

    NVD entryCISA catalog

2021 11 vulnerabilities

1. CVE-2021-1498added Nov 3 2021

   Cisco HyperFlex HX Data Platform Command Injection Vulnerability

   NVD entryCISA catalog

2. CVE-2021-1497added Nov 3 2021

   Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability

   NVD entryCISA catalog

3. CVE-2020-3580Used by ransomwareadded Nov 3 2021

   Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability

   NVD entryCISA catalog

4. CVE-2020-3569added Nov 3 2021

   Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

   NVD entryCISA catalog

5. CVE-2020-3566added Nov 3 2021

   Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

   NVD entryCISA catalog

6. CVE-2020-3452added Nov 3 2021

   Cisco ASA and FTD Read-Only Path Traversal Vulnerability

   NVD entryCISA catalog

7. CVE-2020-3161added Nov 3 2021

   Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability

   NVD entryCISA catalog

8. CVE-2020-3118added Nov 3 2021

   Cisco IOS XR Software Discovery Protocol Format String Vulnerability

   NVD entryCISA catalog

9. CVE-2019-1653added Nov 3 2021

   Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability

   NVD entryCISA catalog

10. CVE-2018-0296added Nov 3 2021

    Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability

    NVD entryCISA catalog

11. CVE-2018-0171added Nov 3 2021

    Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

    NVD entryCISA catalog