Vendor

Cisco

As of , 100 Cisco vulnerabilities are on CISA's list of exploited vulnerabilities, 7 of them used in ransomware campaigns; 18 were added in 2026. Patch first: CVE-2026-20079.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2026-20079Firewall Management Center Authentication Bypass Using an Alternate Path or ChannelCisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall ManagementPatch nowForensic triage required by CISA; Metasploit module0.88
2CVE-2008-4128Cross-Site Request ForgeryCisco IOSPatch nowForensic triage required by CISA; verified Exploit-DB entry0.34
3CVE-2026-76461SQL InjectionCisco Secure Email GatewayPatch nowForensic triage required by CISA0.28
4CVE-2026-20316Secure Firewall Management Center Use of Hard-coded PasswordCisco Secure Firewall Management Center (FMC)Patch nowRansomware use, listed within a year0.35
5CVE-2026-20131Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted DataCisco Secure Firewall Management Center (FMC)Patch nowRansomware use, listed within a year0.43
6CVE-2026-76460Incorrect Use of Privileged APIsCisco Identity Services EnginePatch nowForensic triage required by CISA0.14
7CVE-2026-76504Hex EncodingCisco Catalyst SD-WAN ManagerPatch nowForensic triage required by CISA; listed in the last 14 days0.02
8CVE-2019-1652Small Business Routers Improper Input ValidationCisco Small Business RV320 and RV325 Dual Gigabit WAN VPN RoutersPatch this weekMetasploit module; EPSS 0.96; verified Exploit-DB entry0.96
9CVE-2019-1653Information DisclosureCisco Small Business RV320 and RV325 RoutersPatch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry0.99
10CVE-2026-20182Controller Authentication BypassCisco Catalyst SD-WANPatch this weekMetasploit module; EPSS 0.920.92
11CVE-2026-20127Authentication BypassCisco Catalyst SD-WAN Controller and ManagerPatch this weekMetasploit module; EPSS 0.880.88
12CVE-2023-20273Command InjectionCisco Cisco IOS XE Web UIPatch this weekMetasploit module; EPSS 0.900.90
13CVE-2023-20198Privilege EscalationCisco IOS XE Web UIPatch this weekMetasploit module; EPSS 0.990.99
14CVE-2016-6415IKEv1 Information DisclosureCisco IOS, IOS XR, and IOS XEPatch this weekMetasploit module; EPSS 0.880.88
15CVE-2016-6366SNMP Buffer OverflowCisco Adaptive Security Appliance (ASA)Patch this weekMetasploit module; EPSS 0.880.88
16CVE-2017-3881Remote Code ExecutionCisco IOS and IOS XEPatch this weekMetasploit module; EPSS 0.990.99
17CVE-2022-20699Small Business RV Series Routers Stack-based Buffer OverflowCisco Small Business RV160, RV260, RV340, and RV345 Series RoutersPatch this weekMetasploit module; EPSS 0.720.72
18CVE-2018-0296Denial-of-ServiceCisco Adaptive Security Appliance (ASA)Patch this weekMetasploit module; EPSS 0.990.99
19CVE-2021-1497Installer Virtual Machine Command InjectionCisco HyperFlex HXPatch this weekMetasploit module; EPSS 0.990.99
20CVE-2021-1498Data Platform Command InjectionCisco HyperFlex HXPatch this weekMetasploit module; EPSS 0.990.99
21CVE-2020-3153Mobility Client for Windows Uncontrolled Search PathCisco AnyConnect SecurePatch this weekRansomware use; Metasploit module0.28
22CVE-2020-3433Mobility Client for Windows DLL HijackingCisco AnyConnect SecurePatch this weekRansomware use; Metasploit module0.10
23CVE-2026-20230Server-Side Request Forgery (SSRF)Cisco Unified Communications ManagerPatch this weekEPSS 0.880.88
24CVE-2025-20333Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer OverflowCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefensePatch this weekEPSS 0.710.71
25CVE-2025-20362Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing AuthorizationCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefensePatch this weekEPSS 0.870.87

The next 75, from number 26

Products

  • IOS and IOS XE Software14 entries
  • IOS Software10 entries
  • Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)6 entries
  • IOS XR6 entries
  • Catalyst SD-WAN Manager5 entries
  • Small Business RV160, RV260, RV340, and RV345 Series Routers5 entries
  • Adaptive Security Appliance (ASA)4 entries
  • IOS and IOS XE4 entries
  • Identity Services Engine3 entries
  • IOS Software and Cisco IOS XE Software3 entries
  • AnyConnect Secure2 entries
  • HyperFlex HX2 entries
  • IOS2 entries
  • IOS XE Software2 entries
  • IOS, XR, and XE Software2 entries
  • Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense2 entries
  • Secure Firewall Management Center (FMC)2 entries
  • Unified Communications Manager2 entries
  • Adaptive Security Appliance and Firepower Threat Defense1 entry
  • Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches1 entry
  • Catalyst 6800 Series Switches1 entry
  • Catalyst SD-WAN1 entry
  • Catalyst SD-WAN Controller and Manager1 entry
  • Catalyst SD-WAN Manger1 entry
  • Cisco IOS XE Web UI1 entry
  • Cisco IP Phones1 entry
  • IOS XE Web UI1 entry
  • IOS, IOS XR, and IOS XE1 entry
  • Multiple Products1 entry
  • NX-OS1 entry
  • Prime Data Center Network Manager (DCNM)1 entry
  • RV Series Routers1 entry
  • SD-WAN1 entry
  • Secure Access Control System (ACS)1 entry
  • Secure Email Gateway1 entry
  • Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)1 entry
  • Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management1 entry
  • Small Business RV Series Routers1 entry
  • Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers1 entry
  • Small Business RV320 and RV325 Routers1 entry
  • Smart Licensing Utility1 entry
  • VPN Routers1 entry

Added each year

2040602021: 111120212022: 505020222023: 7720232024: 6620242025: 8820252026: 18182026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
202111
202250
20237
20246
20258
202618

Used in ransomware

Changes CISA made to these entries

  1. CVE-2026-20316 Cisco Secure Firewall Management Center (FMC)Ransomware use: Unknown to Known.
  2. CVE-2026-20122 Cisco Catalyst SD-WAN MangerEdited: notes.
  3. CVE-2025-20393 Cisco Multiple ProductsEdited: notes.
  4. CVE-2025-20352 Cisco IOS and IOS XEEdited: name.

Every change we recorded