Cisco

CPE vendor key: cisco · 791 CVEs published in the last 24 months.

CVEs (365 d)

403

▲ +66 vs prior 30d

Avg CVSS (365 d)

7.08

over 403 CVEs

Avg EPSS pct (365 d)

0.32

higher = more likely exploited

KEV hit rate (365 d)

4.5%

18 of 403 added to CISA KEV

LLM-credited CVEs

none detected

Monthly CVE volume — last 24 months

Each point is one calendar month. Bars in the severity card to the right slice the same volume by CVSS band.

Severity mix

Stacked by CVSS band (Critical / High / Medium / Low) using the best available metric per CVE.

Top affected products (24 mo)

secure_firewall_threat_defense

identity_services_engine

ios_xe

adaptive_security_appliance_software

secure_firewall_management_center

catalyst_sd-wan_manager

identity_services_engine_passive_identity_connector

ios_xr

ios

roomos

Distinct CVEs that include each product in their CPE configuration.

Top CWEs (24 mo)

Distinct CVEs assigned each weakness.

Recent CISA KEV adds (last 12 months)

Added	CVE	Product	KEV name
2026-10-14	CVE-2026-76519	Secure Email Gateway	Cisco Secure Email Gateway Relative Path Traversal Vulnerability
2026-09-30	CVE-2026-76504	Catalyst SD-WAN Manager	Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
2026-09-16	CVE-2026-76460	Identity Services Engine	Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
2026-09-14	CVE-2026-76461	Secure Email Gateway	Cisco Secure Email Gateway SQL Injection Vulnerability
2026-09-09	CVE-2026-20079	Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management	Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
2026-08-11	CVE-2026-20349	Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)	Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
2026-07-29	CVE-2026-20316	Secure Firewall Management Center (FMC)	Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-13	CVE-2008-4128	IOS	Cisco IOS Cross-Site Request Forgery Vulnerability
2026-06-25	CVE-2026-20230	Unified Communications Manager	Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
2026-06-15	CVE-2026-20262	Catalyst SD-WAN Manager	Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability
2026-06-09	CVE-2026-20245	Catalyst SD-WAN Manager	Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability
2026-05-14	CVE-2026-20182	Catalyst SD-WAN	Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
2026-04-20	CVE-2026-20133	Catalyst SD-WAN Manager	Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
2026-04-20	CVE-2026-20128	Catalyst SD-WAN Manager	Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
2026-04-20	CVE-2026-20122	Catalyst SD-WAN Manger	Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
2026-03-19	CVE-2026-20131	Secure Firewall Management Center (FMC)	Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
2026-02-25	CVE-2026-20127	Catalyst SD-WAN Controller and Manager	Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
2026-02-25	CVE-2022-20775	SD-WAN	Cisco SD-WAN Path Traversal Vulnerability
2026-01-21	CVE-2026-20045	Unified Communications Manager	Cisco Unified Communications Products Code Injection Vulnerability
2025-12-17	CVE-2025-20393	Multiple Products	Cisco Multiple Products Improper Input Validation Vulnerability

Filtered to KEV entries whose CISA vendor or product name matches this vendor exactly, to drop cross-OS noise (e.g. third-party Windows apps that CPE-map to Microsoft).

Known exploited, all time (106)

Published	CVE
2026-10-14	CVE-2026-76519
2026-09-30	CVE-2026-76504
2026-09-16	CVE-2026-76460
2026-09-14	CVE-2026-76461
2026-08-11	CVE-2026-20349
2026-07-29	CVE-2026-20316
2026-06-15	CVE-2026-20262
2026-06-04	CVE-2026-20245
2026-06-03	CVE-2026-20230
2026-05-14	CVE-2026-20182
2026-03-04	CVE-2026-20079
2026-03-04	CVE-2026-20131
2026-02-25	CVE-2026-20122
2026-02-25	CVE-2026-20127
2026-02-25	CVE-2026-20128
2026-02-25	CVE-2026-20133
2026-01-21	CVE-2026-20045
2025-12-17	CVE-2025-20393
2025-09-25	CVE-2025-20333
2025-09-25	CVE-2025-20362
2025-09-24	CVE-2025-20352
2025-07-16	CVE-2025-20337
2025-06-25	CVE-2025-20281
2025-04-16	CVE-2025-32433
2024-10-23	CVE-2024-20481
2024-09-04	CVE-2024-20439
2024-07-01	CVE-2024-20399
2024-04-24	CVE-2024-20353
2024-04-24	CVE-2024-20359
2023-10-25	CVE-2023-20273
2023-10-16	CVE-2023-20198
2023-10-10	CVE-2023-44487
2023-09-27	CVE-2023-20109
2023-09-06	CVE-2023-20269
2023-04-13	CVE-2023-20118
2022-09-30	CVE-2022-20775
2022-05-26	CVE-2022-20821
2022-04-01	CVE-2022-22965
2022-02-10	CVE-2022-20699
2022-02-10	CVE-2022-20700
2022-02-10	CVE-2022-20701
2022-02-10	CVE-2022-20703
2022-02-10	CVE-2022-20708
2021-12-10	CVE-2021-44228
2021-05-06	CVE-2021-1497
2021-05-06	CVE-2021-1498
2020-10-21	CVE-2020-3580
2020-09-23	CVE-2020-3569
2020-08-29	CVE-2020-3566
2020-08-17	CVE-2020-3433
2020-07-22	CVE-2020-3452
2020-05-06	CVE-2020-3259
2020-04-15	CVE-2020-3161
2020-02-19	CVE-2020-3153
2020-02-05	CVE-2020-3118
2019-11-26	CVE-2019-15271
2019-01-24	CVE-2019-1652
2019-01-24	CVE-2019-1653
2018-06-07	CVE-2018-0296
2018-03-28	CVE-2018-0151

Attributed by CPE rather than by CISA's vendor name, so it includes CVEs filed under another vendor whose affected-product list names this one — shared library code is the usual reason. Broader, and noisier, than the name-matched card above on purpose.

Generated 16 October 2026 14:24 UTC .