Cisco has 537 CVEs on record between 2017 and 2026. Disclosure cadence is accelerating: 187 in the last 90 days against 23 in the 90 before. The busiest recent month was September 2026 with 96. The median CVSS is 7.4 (high), with 74 rated critical. 4% have been exploited in the wild, in line with the corpus average. When CISA adds a Cisco CVE to KEV it happens fast: a median of 7 days after publication (17 cases). The dominant weakness classes are CWE-20 (41) and CWE-400 (33). Most affected products: secure_firewall_threat_defense (75), identity_services_engine (32), Cisco IOS XE Software (22).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 4% vs 1% corpus
- Median CVSS
- 7.4
- Publish → KEV
- 7 d median(17)
- Last 90 days
- 187 prev 23
Weakness classes
Products
- secure_firewall_threat_defense 75
- identity_services_engine 32
- Cisco IOS XE Software 22
- Cisco Identity Services Engine Software 21
- enterprise_nfv_infrastructure_software 21
- ios 21
Worst active — by depth score
CVE-2026-20079Critical· 10.0A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access …98CVE-2026-76460Critical· 10.0A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint95CVE-2026-20230High· 8.6A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forg…90CVE-2026-76504Critical· 9.8A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is …87CVE-2025-20393Critical· 10.0Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability86
Cisco vulnerabilities
CVEs affecting Cisco, newest first. Open any entry for full detail, references, and exploit status.
537 CVEsRSS
CVE-2026-20179Medium· 5.8Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities
Multiple Cisco products are affected by a vulnerability in the Snort 3 Generic Routing Encapsulation (GRE) Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting …
CVE-2026-20011Medium· 5.8Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort 3 SMTP MIME Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This vulnerability is due to a lack of err…
CVE-2026-20291High· 7.8Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software harde…
CVE-2026-20043Critical· 9.0Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software harde…
CVE-2026-20019Medium· 5.8Multiple Cisco Products Snort 3 Netflow Denial of Service Vulnerabilities
Multiple Cisco products are affected by a vulnerability in the Snort 3 NetFlow Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet…
CVE-2026-20356High· 7.5Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software harde…
CVE-2026-76462Medium· 5.5Cisco Secure Client Privilege Escalation Vulnerability
A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability …
CVE-2026-20218Medium· 5.8Cisco Secure Firewall Threat Defense Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting i…
CVE-2026-20197Medium· 5.8Multiple Cisco Products Snort 3 Teredo Protocol Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort 3 Teredo Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet …
CVE-2026-20236High· 7.5Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software harde…
CVE-2026-20221Medium· 5.8Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities
Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected r…
CVE-2026-76466Critical· 9.8PoCCisco Expressway Series Remote Code Execution Vulnerability
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root. T…
CVE-2026-76445Medium· 5.3Multiple Cisco Products Snort 3 Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) co…
CVE-2026-76435Medium· 5.3Cisco Expressway Series Information Disclosure Vulnerability
A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to insufficient authorization checks of HTTP requests during…
CVE-2026-76477High· 8.8Cisco Unified Communications Products Hardening Release: October 2026 - Injection Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Comm…
CVE-2026-76474Critical· 9.8Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Comm…
CVE-2026-76473Critical· 9.8Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Comm…
CVE-2026-76476High· 8.8Cisco Unified Communications Products Hardening Release: October 2026 - Improper Input Validation Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Comm…
CVE-2026-76475Critical· 9.3Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Comm…
CVE-2026-76487Medium· 5.3Cisco Unified Communications Manager Improper Access Control Vulnerability
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass at…
CVE-2026-76478High· 8.8Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Comm…
CVE-2026-76481High· 7.5Cisco Unified Communications Products Hardening Release: October 2026 - Improper Check or Handling of Exceptional Conditions Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Comm…
CVE-2026-76479High· 7.8Cisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Comm…
CVE-2026-76492High· 7.5Cisco Expressway Series Software Hardening Release: October 2026 - NULL Pointer Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening rel…
CVE-2026-76491High· 7.5Cisco Expressway Series Software Hardening Release: October 2026 - Denial of Service Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening rel…
CVE-2026-76489Medium· 5.8Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruptio…
CVE-2026-76505High· 7.5Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability
A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow…
CVE-2026-76493High· 7.5Cisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening rel…
CVE-2026-76490High· 8.6Cisco Expressway Series Software Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening rel…
CVE-2026-76496High· 7.0Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening rel…