Skip to content
Noroxi

Cisco records

6,757 published records for vendor Cisco. 108 of them have been exploited in the wild (listed in CISA KEV) and 155 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
108 · 1.6%
Weaponized
155 · 2.3%
Pre-auth RCE
648
With a fix record
1%
Median publish → KEV
862 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 21
  7. 22
  8. 23
  9. 24
  10. 25
  11. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

6,757 records
  • CVE-2021-44228
    100Now

    Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    apache · log4jDec 10, 2021

  • CVE-2023-20198
    100Now

    Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software.

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    cisco · ios xeOct 16, 2023

  • CVE-2025-32433
    100Now

    Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

    CriticalCVSS 10.0KEVWeaponizedEPSS 98%

    erlang · erlang\/otpApr 16, 2025

  • CVE-2021-1498
    99Now

    Cisco HyperFlex HX Command Injection Vulnerabilities

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    cisco · hyperflex hx data platformMay 6, 2021

  • CVE-2021-1497
    99Now

    Cisco HyperFlex HX Command Injection Vulnerabilities

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    cisco · hyperflex hx data platformMay 6, 2021

  • CVE-2022-22965
    99Now

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    vmware · spring frameworkApr 1, 2022

  • CVE-2018-0171
    99Now

    A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    cisco · iosMar 28, 2018

  • CVE-2017-3881
    99Now

    A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthe

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    cisco · iosMar 17, 2017

  • CVE-2025-20281
    99Now

    Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

    CriticalCVSS 10.0KEVWeaponizedEPSS 97%

    cisco · identity services engineJun 25, 2025

  • CVE-2024-20439
    98Now

    A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by us

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    cisco · smart license utilitySep 4, 2024

  • CVE-2026-20182
    97Now

    Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

    CriticalCVSS 10.0KEVWeaponizedEPSS 91%

    cisco · catalyst sd-wan managerMay 14, 2026

  • CVE-2026-20079
    97Now

    Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability

    CriticalCVSS 10.0KEVWeaponizedEPSS 88%

    cisco · secure firewall management centerMar 4, 2026

  • CVE-2026-20127
    96Now

    Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

    CriticalCVSS 10.0KEVWeaponizedEPSS 87%

    cisco · catalyst sd-wan managerFeb 25, 2026

  • CVE-2020-3161
    94Now

    Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 83%

    cisco · ip phone 8865 firmwareApr 15, 2020

  • CVE-2026-76460
    93Now

    Cisco Identity Services Engine Authentication Bypass Vulnerability

    CriticalCVSS 10.0KEVWeaponizedEPSS 75%

    cisco · identity services engineSep 16, 2026

  • CVE-2017-9805
    92Now

    The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStrea

    HighCVSS 8.1KEVWeaponizedEPSS 99%

    apache · strutsSep 15, 2017

  • CVE-2025-20337
    92Now

    Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

    CriticalCVSS 10.0KEVWeaponizedEPSS 74%

    cisco · identity services engineJul 16, 2025

  • CVE-2026-20230
    91Now

    Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

    HighCVSS 8.6KEVWeaponizedEPSS 88%

    cisco · unified communications managerJun 3, 2026

  • CVE-2016-6366
    91Now

    Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V,

    HighCVSS 8.8KEVWeaponizedEPSS 87%

    cisco · pix firewall softwareAug 18, 2016

  • CVE-2022-20699
    91Now

    Cisco Small Business RV Series Routers Vulnerabilities

    CriticalCVSS 9.8KEVWeaponizedEPSS 72%

    cisco · rv340 firmwareFeb 10, 2022

  • CVE-2025-20333
    91Now

    A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat D

    CriticalCVSS 9.9KEVWeaponizedEPSS 72%

    cisco · adaptive security appliance softwareSep 25, 2025

  • CVE-2023-44487
    90Now

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    siemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmwareOct 10, 2023

  • CVE-2020-3452
    90Now

    Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    cisco · adaptive security appliance softwareJul 22, 2020

  • CVE-2018-0296
    90Now

    A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    cisco · adaptive security appliance softwareJun 7, 2018

  • CVE-2019-1653
    90Now

    Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    cisco · rv320 firmwareJan 24, 2019