Cisco vulnerabilities
We track 810 vulnerabilities in Cisco products across 60+ products. 790 are rated high or critical, and 106 have been exploited in real attacks. The most recent was published on November 4, 2026.
Latest Cisco vulnerabilities
- 8.1 High severity
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE)…
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read and delete files on an affected device. This vulnerability is due to insufficient validation of user-supplied in
- 7.2 High severity
Cisco RoomOS Software: Improper Limitation of a Pathname to a Restricted Directory
Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information a
- 7.7 High severity
Cisco IOS: Improper Handling of Exceptional Conditions
A vulnerability in the SSH implementation of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. This vulnerability is due to improper handling of resources during an exceptional sit
- 7.4 High severity
Cisco IOS XE Software: Interpretation Conflict
A vulnerability in the implementation of IPv6 VPN over MPLS (6VPE) with Zone-Based Firewall (ZBFW) of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability
- 8.6 High severity
Cisco IOS XE Software: Improper Handling of Length Parameter Inconsistency
A vulnerability in the egress MPLS packet processing function of Cisco IOS XE Software for Cisco Catalyst 3650, Catalyst 3850, and Catalyst 9000 Family Switches could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly,
- 8.6 High severity
Cisco IOS XE Software: Improper Check for Unusual or Exceptional Conditions
A vulnerability in the DNS application layer gateway (ALG) functionality that is used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due
- 7.5 High severity
Cisco IOS: Improper Handling of Exceptional Conditions
A vulnerability in the processing of malformed Common Industrial Protocol (CIP) packets that are sent to Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting
- 7.5 High severity
Cisco IOS XE Software: Improper Control of a Resource Through its Lifetime
A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) Mobility messages in Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of se
- 7.2 High severity
Cisco IOS XE Software: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this v
- 7.1 High severity
A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN…
A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitrary files from the file system of an affected device. This vulnerability is due to insufficient input
- 7.5 High severity
A vulnerability in the UDP processing functionality of Cisco IOS XE Software for Embedded…
A vulnerability in the UDP processing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst 9100 Series Access Points could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerabilit
- 7.5 High severity
A vulnerability in the DHCP processing functionality of Cisco IOS XE Wireless Controller…
A vulnerability in the DHCP processing functionality of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to the improp
- 7.8 High severity
Cisco SD-WAN Solution: Improper Limitation of a Pathname to a Restricted Directory
Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit t
- 7.8 High severity
Cisco SD-WAN Path Traversal Exploited
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerabi
- 9.8 Critical severity
Cisco Small Business RV Series Router Firmware: Improper Authentication
A vulnerability in the IPSec VPN Server authentication functionality of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to bypass authentication controls and access the IPSec VPN network. This vuln
- 8.8 High severity
Cisco SD-WAN vManage: Improper Access Control
A vulnerability in the binding configuration of Cisco SD-WAN vManage Software containers could allow an unauthenticated, adjacent attacker who has access to the VPN0 logical network to also access the messaging service ports on an affected system. This vulnera
- 8.8 High severity
Cisco ACI Multi-Site Orchestrator Software: Improper Authorization
A vulnerability in the API implementation of Cisco ACI Multi-Site Orchestrator (MSO) could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to improper authorization on specific APIs. An attacker co
- 8.8 High severity
Cisco NX-OS Software: Out-of-bounds Write
A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected
- 8.6 High severity
Cisco NX-OS Software: Out-of-bounds Read
A vulnerability in the OSPF version 3 (OSPFv3) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incomplete input validation of speci
- 7.5 High severity
Cisco Adaptive Security Appliance (ASA) Software: Observable Discrepancy
A vulnerability in the handling of RSA keys on devices running Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve an RSA private key. This vulnerability
- 9.8 Critical severity
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers…
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. For more information ab
- 10.0 Critical severity
Cisco Small Business RV Series Router Firmware: Improper Neutralization of Special Elements used in an OS Command
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. For more information ab
- 8.1 High severity
Cisco Unified Communications Manager: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to delete arbitrary fi
- 7.8 High severity
Clam AntiVirus (ClamAV): Out-of-bounds Write
A vulnerability in the regex module used by the signature database load module of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an authenticated, local attacker to crash ClamAV at database load
- 9.0 Critical severity
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers…
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. For more information ab
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Buffer Copy without Checking Size of Input
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Buffer Copy without Checking Size of Input
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Improper Neutralization of Special Elements used in an OS Command
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Buffer Copy without Checking Size of Input
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Buffer Copy without Checking Size of Input
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Buffer Copy without Checking Size of Input
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Buffer Copy without Checking Size of Input
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Buffer Copy without Checking Size of Input
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Buffer Copy without Checking Size of Input
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Buffer Copy without Checking Size of Input
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Buffer Copy without Checking Size of Input
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Buffer Copy without Checking Size of Input
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Buffer Copy without Checking Size of Input
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Buffer Copy without Checking Size of Input
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe
- 7.2 High severity
Cisco Small Business RV Series Router Firmware: Buffer Copy without Checking Size of Input
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe