Cyberfeed6 › Vendors › Cisco
CISA lists 102 Cisco vulnerabilities as exploited in real attacks, and 7 of them are known to be used in ransomware campaigns. Most entries concern IOS and IOS XE Software, Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD), IOS XR, IOS software.
Showing the 40 most recently added of 102. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2026-76418Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | Secure Firewall ASA Software and Cisco Secure FTD Software | 2026-10-29 | High (8.6) | No | Vendor notice |
| CVE-2026-76519Cisco Secure Email Gateway Relative Path Traversal Vulnerability | Secure Email Gateway | 2026-10-14 | Critical (9.8) | No | Vendor notice |
| CVE-2026-76504Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | Catalyst SD-WAN Manager | 2026-09-30 | Critical (9.8) | No | Vendor notice |
| CVE-2026-76460Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | Identity Services Engine | 2026-09-16 | Critical (10.0) | No | Vendor notice |
| CVE-2026-76461Cisco Secure Email Gateway SQL Injection Vulnerability | Secure Email Gateway | 2026-09-14 | Critical (9.8) | No | Vendor notice |
| CVE-2026-20079Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | 2026-09-09 | Critical (10.0) | No | Vendor notice |
| CVE-2026-20349Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | 2026-08-11 | High (8.6) | No | Vendor notice |
| CVE-2026-20316Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability | Secure Firewall Management Center (FMC) | 2026-07-29 | Medium (5.3) | Yes | Vendor notice |
| CVE-2008-4128Cisco IOS Cross-Site Request Forgery Vulnerability | IOS | 2026-07-13 | High (8.1) | No | Vendor notice |
| CVE-2026-20230Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability | Unified Communications Manager | 2026-06-25 | High (8.6) | No | Vendor notice |
| CVE-2026-20262Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability | Catalyst SD-WAN Manager | 2026-06-15 | Medium (6.5) | No | Vendor notice |
| CVE-2026-20245Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability | Catalyst SD-WAN Manager | 2026-06-09 | High (7.8) | No | Vendor notice |
| CVE-2026-20182Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability | Catalyst SD-WAN | 2026-05-14 | Critical (10.0) | No | Vendor notice |
| CVE-2026-20133Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | Catalyst SD-WAN Manager | 2026-04-20 | Medium (6.5) | No | Vendor notice |
| CVE-2026-20128Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability | Catalyst SD-WAN Manager | 2026-04-20 | High (7.5) | No | Vendor notice |
| CVE-2026-20122Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability | Catalyst SD-WAN Manger | 2026-04-20 | Medium (5.4) | No | Vendor notice |
| CVE-2026-20131Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability | Secure Firewall Management Center (FMC) | 2026-03-19 | Critical (10.0) | Yes | Vendor notice |
| CVE-2026-20127Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability | Catalyst SD-WAN Controller and Manager | 2026-02-25 | Critical (10.0) | No | Vendor notice |
| CVE-2022-20775Cisco SD-WAN Path Traversal Vulnerability | SD-WAN | 2026-02-25 | High (7.8) | No | Vendor notice |
| CVE-2026-20045Cisco Unified Communications Products Code Injection Vulnerability | Unified Communications Manager | 2026-01-21 | High (8.2) | No | Vendor notice |
| CVE-2025-20393Cisco Multiple Products Improper Input Validation Vulnerability | Multiple Products | 2025-12-17 | Critical (10.0) | No | Vendor notice |
| CVE-2025-20352Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability | IOS and IOS XE | 2025-09-29 | High (7.7) | No | Vendor notice |
| CVE-2025-20362Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | 2025-09-25 | Medium (6.5) | No | Vendor notice |
| CVE-2025-20333Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability | Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | 2025-09-25 | Critical (9.9) | No | Vendor notice |
| CVE-2025-20337Cisco Identity Services Engine Injection Vulnerability | Identity Services Engine | 2025-07-28 | Critical (10.0) | No | Vendor notice |
| CVE-2025-20281Cisco Identity Services Engine Injection Vulnerability | Identity Services Engine | 2025-07-28 | Critical (10.0) | No | Vendor notice |
| CVE-2024-20439Cisco Smart Licensing Utility Static Credential Vulnerability | Smart Licensing Utility | 2025-03-31 | Critical (9.8) | No | Vendor notice |
| CVE-2023-20118Cisco Small Business RV Series Routers Command Injection Vulnerability | Small Business RV Series Routers | 2025-03-03 | Medium (6.5) | No | Vendor notice |
| CVE-2014-2120Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability | Adaptive Security Appliance (ASA) | 2024-11-12 | Medium (5.4) | No | Vendor notice |
| CVE-2024-20481Cisco ASA and FTD Denial-of-Service Vulnerability | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | 2024-10-24 | Medium (5.8) | No | Vendor notice |
| CVE-2024-20399Cisco NX-OS Command Injection Vulnerability | NX-OS | 2024-07-02 | Medium (6.0) | No | Vendor notice |
| CVE-2024-20359Cisco ASA and FTD Privilege Escalation Vulnerability | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | 2024-04-24 | Medium (6.0) | No | Vendor notice |
| CVE-2024-20353Cisco ASA and FTD Denial of Service Vulnerability | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | 2024-04-24 | High (8.6) | No | Vendor notice |
| CVE-2020-3259Cisco ASA and FTD Information Disclosure Vulnerability | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | 2024-02-15 | High (7.5) | Yes | Vendor notice |
| CVE-2023-20273Cisco IOS XE Web UI Command Injection Vulnerability | Cisco IOS XE Web UI | 2023-10-23 | High (7.2) | No | Vendor notice |
| CVE-2023-20198Cisco IOS XE Web UI Privilege Escalation Vulnerability | IOS XE Web UI | 2023-10-16 | Critical (10.0) | No | Vendor notice |
| CVE-2023-20109Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability | IOS and IOS XE | 2023-10-10 | Medium (6.6) | No | Vendor notice |
| CVE-2023-20269Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability | Adaptive Security Appliance and Firepower Threat Defense | 2023-09-13 | Medium (5.0) | Yes | Vendor notice |
| CVE-2016-6415Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability | IOS, IOS XR, and IOS XE | 2023-05-19 | High (7.5) | No | Vendor notice |
| CVE-2004-1464Cisco IOS Denial-of-Service Vulnerability | IOS | 2023-05-19 | Medium (5.9) | No | Vendor notice |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.