Cisco vulnerabilities
- Cisco has 1,032 CVE records published between 28 Oct 2023 and 28 Oct 2026, ranking #15 of 420 vendors on this site by that count.
- Of the 1,032 with a CVSS score, 406 (39.3%) are rated critical or high; 0 (0% of all) have no CVSS score.
- 101 vulnerabilities attributed to Cisco are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog; the most recent, CVE-2026-76519, was added on 14 Oct 2026.
- 7 of them (6.9%) are marked as known to be used in ransomware campaigns.
- For the 101 KEV entries with a published CVE record, the median time from CVE publication to KEV listing is 1,014 days.
Records are attributed to Cisco from the vendor named in the source records. About the data.
CVE records per year
Show data as a table
| Year | CVE records |
|---|---|
| 2017 | 466 |
| 2018 | 467 |
| 2019 | 566 |
| 2020 | 558 |
| 2021 | 586 |
| 2022 | 317 |
| 2023 | 264 |
| 2024 | 361 |
| 2025 | 239 |
| 2026 | 392 |
2026 is partial (through 28 Oct 2026), shown in a lighter bar.
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026 | 392 | 81 | 135 | 55.1% | 0% |
| 2025 | 239 | 16 | 65 | 33.9% | 0% |
| 2024 | 361 | 15 | 84 | 27.4% | 0% |
| 2023 | 264 | 13 | 67 | 30.5% | 0.8% |
| 2022 | 317 | 33 | 74 | 33.9% | 0.3% |
| 2021 | 586 | 45 | 252 | 50.8% | 0.2% |
| 2020 | 558 | 39 | 232 | 49.3% | 1.4% |
| 2019 | 566 | 21 | 230 | 44.6% | 0.5% |
| 2018 | 467 | 7 | 23 | 53.6% | 88% |
| 2017 | 466 | 2 | 15 | 85% | 95.7% |
| Before 2017 | 2,210 | ||||
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Exploited vulnerabilities in CISA's KEV catalog
| CVE | Product | Name | Added | Ransomware |
|---|---|---|---|---|
| CVE-2026-76519 | Secure Email Gateway | Cisco Secure Email Gateway Relative Path Traversal Vulnerability | 2026-10-14 | Unknown |
| CVE-2026-76504 | Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | 2026-09-30 | Unknown |
| CVE-2026-76460 | Identity Services Engine | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | 2026-09-16 | Unknown |
| CVE-2026-76461 | Secure Email Gateway | Cisco Secure Email Gateway SQL Injection Vulnerability | 2026-09-14 | Unknown |
| CVE-2026-20079 | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-09-09 | Unknown |
| CVE-2026-20349 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability | 2026-08-11 | Unknown |
| CVE-2026-20316 | Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability | 2026-07-29 | Known |
| CVE-2008-4128 | IOS | Cisco IOS Cross-Site Request Forgery Vulnerability | 2026-07-13 | Unknown |
| CVE-2026-20230 | Unified Communications Manager | Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability | 2026-06-25 | Unknown |
| CVE-2026-20262 | Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability | 2026-06-15 | Unknown |
| CVE-2026-20245 | Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability | 2026-06-09 | Unknown |
| CVE-2026-20182 | Catalyst SD-WAN | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability | 2026-05-14 | Unknown |
| CVE-2026-20122 | Catalyst SD-WAN Manger | Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability | 2026-04-20 | Unknown |
| CVE-2026-20128 | Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability | 2026-04-20 | Unknown |
| CVE-2026-20133 | Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | 2026-04-20 | Unknown |
| CVE-2026-20131 | Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability | 2026-03-19 | Known |
| CVE-2022-20775 | SD-WAN | Cisco SD-WAN Path Traversal Vulnerability | 2026-02-25 | Unknown |
| CVE-2026-20127 | Catalyst SD-WAN Controller and Manager | Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability | 2026-02-25 | Unknown |
| CVE-2026-20045 | Unified Communications Manager | Cisco Unified Communications Products Code Injection Vulnerability | 2026-01-21 | Unknown |
| CVE-2025-20393 | Multiple Products | Cisco Multiple Products Improper Input Validation Vulnerability | 2025-12-17 | Unknown |
| CVE-2025-20352 | IOS and IOS XE | Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability | 2025-09-29 | Unknown |
| CVE-2025-20333 | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability | 2025-09-25 | Unknown |
| CVE-2025-20362 | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability | 2025-09-25 | Unknown |
| CVE-2025-20281 | Identity Services Engine | Cisco Identity Services Engine Injection Vulnerability | 2025-07-28 | Unknown |
| CVE-2025-20337 | Identity Services Engine | Cisco Identity Services Engine Injection Vulnerability | 2025-07-28 | Unknown |
| CVE-2024-20439 | Smart Licensing Utility | Cisco Smart Licensing Utility Static Credential Vulnerability | 2025-03-31 | Unknown |
| CVE-2023-20118 | Small Business RV Series Routers | Cisco Small Business RV Series Routers Command Injection Vulnerability | 2025-03-03 | Unknown |
| CVE-2014-2120 | Adaptive Security Appliance (ASA) | Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability | 2024-11-12 | Unknown |
| CVE-2024-20481 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Denial-of-Service Vulnerability | 2024-10-24 | Unknown |
| CVE-2024-20399 | NX-OS | Cisco NX-OS Command Injection Vulnerability | 2024-07-02 | Unknown |
| CVE-2024-20353 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Denial of Service Vulnerability | 2024-04-24 | Unknown |
| CVE-2024-20359 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Privilege Escalation Vulnerability | 2024-04-24 | Unknown |
| CVE-2020-3259 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Information Disclosure Vulnerability | 2024-02-15 | Known |
| CVE-2023-20273 | Cisco IOS XE Web UI | Cisco IOS XE Web UI Command Injection Vulnerability | 2023-10-23 | Unknown |
| CVE-2023-20198 | IOS XE Web UI | Cisco IOS XE Web UI Privilege Escalation Vulnerability | 2023-10-16 | Unknown |
| CVE-2023-20109 | IOS and IOS XE | Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability | 2023-10-10 | Unknown |
| CVE-2023-20269 | Adaptive Security Appliance and Firepower Threat Defense | Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability | 2023-09-13 | Known |
| CVE-2004-1464 | IOS | Cisco IOS Denial-of-Service Vulnerability | 2023-05-19 | Unknown |
| CVE-2016-6415 | IOS, IOS XR, and IOS XE | Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability | 2023-05-19 | Unknown |
| CVE-2017-6742 | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2023-04-19 | Unknown |
| CVE-2020-3153 | AnyConnect Secure | Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability | 2022-10-24 | Known |
| CVE-2020-3433 | AnyConnect Secure | Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability | 2022-10-24 | Known |
| CVE-2019-15271 | RV Series Routers | Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability | 2022-06-08 | Unknown |
| CVE-2016-6366 | Adaptive Security Appliance (ASA) | Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability | 2022-05-24 | Unknown |
| CVE-2016-6367 | Adaptive Security Appliance (ASA) | Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability | 2022-05-24 | Unknown |
| CVE-2022-20821 | IOS XR | Cisco IOS XR Open Port Vulnerability | 2022-05-23 | Unknown |
| CVE-2009-2055 | IOS XR | Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability | 2022-03-25 | Unknown |
| CVE-2010-3035 | IOS XR | Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability | 2022-03-25 | Unknown |
| CVE-2015-0666 | Prime Data Center Network Manager (DCNM) | Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability | 2022-03-25 | Unknown |
| CVE-2017-3881 | IOS and IOS XE | Cisco IOS and IOS XE Remote Code Execution Vulnerability | 2022-03-25 | Unknown |
| CVE-2018-0125 | VPN Routers | Cisco VPN Routers Remote Code Execution Vulnerability | 2022-03-25 | Unknown |
| CVE-2018-0147 | Secure Access Control System (ACS) | Cisco Secure Access Control System Java Deserialization Vulnerability | 2022-03-25 | Unknown |
| CVE-2017-12231 | IOS software | Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-12232 | IOS software | Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-12233 | IOS software | Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-12234 | IOS software | Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-12235 | IOS software | Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-12237 | IOS and IOS XE Software | Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-12238 | Catalyst 6800 Series Switches | Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-12240 | IOS and IOS XE Software | Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-12319 | IOS XE Software | Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-6627 | IOS and IOS XE Software | Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-6663 | IOS and IOS XE Software | Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-6736 | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-6737 | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-6738 | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-6739 | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-6740 | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-6743 | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-6744 | IOS software | Cisco IOS Software SNMP Remote Code Execution Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0151 | IOS and IOS XE Software | Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0154 | IOS Software | Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0155 | Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches | Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0156 | IOS Software and Cisco IOS XE Software | Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0158 | IOS Software and Cisco IOS XE Software | Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0159 | IOS Software and Cisco IOS XE Software | Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0161 | IOS Software | Cisco IOS Software Resource Management Errors Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0167 | IOS, XR, and XE Software | Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0172 | IOS and IOS XE Software | Cisco IOS and IOS XE Software Improper Input Validation Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0173 | IOS and IOS XE Software | Cisco IOS and IOS XE Software Improper Input Validation Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0174 | IOS XE Software | Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0175 | IOS, XR, and XE Software | Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0179 | IOS Software | Cisco IOS Software Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0180 | IOS Software | Cisco IOS Software Denial-of-Service Vulnerability | 2022-03-03 | Unknown |
| CVE-2019-1652 | Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers | Cisco Small Business Routers Improper Input Validation Vulnerability | 2022-03-03 | Unknown |
| CVE-2022-20699 | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | Unknown |
| CVE-2022-20700 | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | Unknown |
| CVE-2022-20701 | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | Unknown |
| CVE-2022-20703 | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | Unknown |
| CVE-2022-20708 | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-0171 | IOS and IOS XE | Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability | 2021-11-03 | Unknown |
| CVE-2018-0296 | Adaptive Security Appliance (ASA) | Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability | 2021-11-03 | Unknown |
| CVE-2019-1653 | Small Business RV320 and RV325 Routers | Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-3118 | IOS XR | Cisco IOS XR Software Discovery Protocol Format String Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-3161 | Cisco IP Phones | Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-3452 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Read-Only Path Traversal Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-3566 | IOS XR | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-3569 | IOS XR | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-3580 | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability | 2021-11-03 | Known |
| CVE-2021-1497 | HyperFlex HX | Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-1498 | HyperFlex HX | Cisco HyperFlex HX Data Platform Command Injection Vulnerability | 2021-11-03 | Unknown |
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. These are the 10 highest-scoring Cisco records today.
| CVE | EPSS | Percentile | Severity | In KEV |
|---|---|---|---|---|
| CVE-2021-1498 | 100% | 100% | Critical | Yes |
| CVE-2020-3452 | 100% | 100% | High | Yes |
| CVE-2021-1497 | 99.9% | 100% | Critical | Yes |
| CVE-2018-0296 | 99.9% | 100% | High | Yes |
| CVE-2019-1653 | 99.9% | 100% | High | Yes |
| CVE-2023-20198 | 99.6% | 99.9% | Critical | Yes |
| CVE-2018-0171 | 99.5% | 99.9% | High | Yes |
| CVE-2017-3881 | 99% | 99.9% | Critical | Yes |
| CVE-2019-1821 | 98.1% | 99.9% | High | No |
| CVE-2025-20281 | 97.6% | 99.9% | Critical | Yes |
Source: FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.