Cisco: CISA KEV History
Every Cisco vulnerability in the CISA Known Exploited Vulnerabilities catalog: confirmed in-the-wild exploitation, addition timeline, and ransomware linkage. Rebuilt automatically on every site deploy.
Snapshot: 2026-10-16 · Source: CISA KEV Catalog · Full KEV dashboard · Additions by date
KEV entries
101
Added, last 12 months
20
Ransomware-linked
7
Latest addition
2026-10-14
Cisco KEV additions per month, last 24 months
Most-listed products: IOS and IOS XE Software, Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD), IOS XR, IOS software, Catalyst SD-WAN Manager.
Latest 50 of 101 Cisco KEV entries
| CVE | Vulnerability | Added | Ransomware |
|---|---|---|---|
| CVE-2026-76519 | Cisco Secure Email Gateway Relative Path Traversal Vulnerability | 2026-10-14 | No |
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | 2026-09-30 | No |
| CVE-2026-76460 | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | 2026-09-16 | No |
| CVE-2026-76461 | Cisco Secure Email Gateway SQL Injection Vulnerability | 2026-09-14 | No |
| CVE-2026-20079 | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel | 2026-09-09 | No |
| CVE-2026-20349 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense | 2026-08-11 | No |
| CVE-2026-20316 | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability | 2026-07-29 | Yes |
| CVE-2008-4128 | Cisco IOS Cross-Site Request Forgery Vulnerability | 2026-07-13 | No |
| CVE-2026-20230 | Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability | 2026-06-25 | No |
| CVE-2026-20262 | Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability | 2026-06-15 | No |
| CVE-2026-20245 | Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability | 2026-06-09 | No |
| CVE-2026-20182 | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability | 2026-05-14 | No |
| CVE-2026-20122 | Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability | 2026-04-20 | No |
| CVE-2026-20133 | Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor V | 2026-04-20 | No |
| CVE-2026-20128 | Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability | 2026-04-20 | No |
| CVE-2026-20131 | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (S | 2026-03-19 | Yes |
| CVE-2022-20775 | Cisco SD-WAN Path Traversal Vulnerability | 2026-02-25 | No |
| CVE-2026-20127 | Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability | 2026-02-25 | No |
| CVE-2026-20045 | Cisco Unified Communications Products Code Injection Vulnerability | 2026-01-21 | No |
| CVE-2025-20393 | Cisco Multiple Products Improper Input Validation Vulnerability | 2025-12-17 | No |
| CVE-2025-20352 | Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerabili | 2025-09-29 | No |
| CVE-2025-20362 | Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense | 2025-09-25 | No |
| CVE-2025-20333 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense | 2025-09-25 | No |
| CVE-2025-20337 | Cisco Identity Services Engine Injection Vulnerability | 2025-07-28 | No |
| CVE-2025-20281 | Cisco Identity Services Engine Injection Vulnerability | 2025-07-28 | No |
| CVE-2024-20439 | Cisco Smart Licensing Utility Static Credential Vulnerability | 2025-03-31 | No |
| CVE-2023-20118 | Cisco Small Business RV Series Routers Command Injection Vulnerability | 2025-03-03 | No |
| CVE-2014-2120 | Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability | 2024-11-12 | No |
| CVE-2024-20481 | Cisco ASA and FTD Denial-of-Service Vulnerability | 2024-10-24 | No |
| CVE-2024-20399 | Cisco NX-OS Command Injection Vulnerability | 2024-07-02 | No |
| CVE-2024-20359 | Cisco ASA and FTD Privilege Escalation Vulnerability | 2024-04-24 | No |
| CVE-2024-20353 | Cisco ASA and FTD Denial of Service Vulnerability | 2024-04-24 | No |
| CVE-2020-3259 | Cisco ASA and FTD Information Disclosure Vulnerability | 2024-02-15 | Yes |
| CVE-2023-20273 | Cisco IOS XE Web UI Command Injection Vulnerability | 2023-10-23 | No |
| CVE-2023-20198 | Cisco IOS XE Web UI Privilege Escalation Vulnerability | 2023-10-16 | No |
| CVE-2023-20109 | Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability | 2023-10-10 | No |
| CVE-2023-20269 | Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnera | 2023-09-13 | Yes |
| CVE-2004-1464 | Cisco IOS Denial-of-Service Vulnerability | 2023-05-19 | No |
| CVE-2016-6415 | Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability | 2023-05-19 | No |
| CVE-2017-6742 | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 2023-04-19 | No |
| CVE-2020-3433 | Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability | 2022-10-24 | Yes |
| CVE-2020-3153 | Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability | 2022-10-24 | Yes |
| CVE-2019-15271 | Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability | 2022-06-08 | No |
| CVE-2016-6366 | Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability | 2022-05-24 | No |
| CVE-2016-6367 | Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability | 2022-05-24 | No |
| CVE-2022-20821 | Cisco IOS XR Open Port Vulnerability | 2022-05-23 | No |
| CVE-2018-0147 | Cisco Secure Access Control System Java Deserialization Vulnerability | 2022-03-25 | No |
| CVE-2018-0125 | Cisco VPN Routers Remote Code Execution Vulnerability | 2022-03-25 | No |
| CVE-2017-3881 | Cisco IOS and IOS XE Remote Code Execution Vulnerability | 2022-03-25 | No |
| CVE-2015-0666 | Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability | 2022-03-25 | No |
CVE links go to our explainer when one exists, otherwise to the NVD record.
Our Cisco CVE explainers
Plain-English impact, affected versions, and a response runbook for each, sourced from NVD and vendor advisories.
Data: official CISA KEV catalog, fetched at build time. Figures may be reused with attribution to East Bay Cyber and CISA. See also the KEV Velocity Dashboard and all tracked vendors.