Cisco vulnerabilities
We track 810 vulnerabilities in Cisco products across 60+ products. 790 are rated high or critical, and 106 have been exploited in real attacks. The most recent was published on November 4, 2026.
Latest Cisco vulnerabilities
- 7.5 High severity
Cisco Campus Gateway Software: Improper Control of a Resource Through its Lifetime
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internal
- 9.8 Critical severity
Cisco NX-OS Software: Free of Memory not on the Heap
A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code wit
- 9.6 Critical severity
Cisco Campus Gateway Software: Improper Restriction of Operations within the Bounds of a Memory Buffer
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internal
- 8.8 High severity
Cisco Campus Gateway Software: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internal
- 9.8 Critical severity
Cisco NX-OS Software: Out-of-bounds Write
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally di
- 8.6 High severity
Cisco NX-OS Software: Improper Check or Handling of Exceptional Conditions
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally di
- 8.6 High severity
Cisco NX-OS Software: Out-of-bounds Read
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally di
- 8.6 High severity
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco…
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally di
- 9.8 Critical severity
Cisco NX-OS Software: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally di
- 9.1 Critical severity
Cisco License On-Prem: Relative Path Traversal
A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on a
- 8.8 High severity
Cisco NX-OS Software: Improper Neutralization
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally di
- 7.2 High severity
Cisco Finesse: Server-Side Request Forgery
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for
- 9.1 Critical severity
Cisco License On-Prem: Missing Authorization
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerabil
- 9.8 Critical severity
Cisco Catalyst SD-WAN Manager Hex Encoding Exploited
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling o
- 10.0 Critical severity
Cisco Identity Services Engine Incorrect Use of Privileged APIs Exploited
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vuln
- 7.6 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into
- 7.2 High severity
Cisco Identity Services Engine Software: Relative Path Traversal
A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerab
- 8.2 High severity
Cisco Secure Firewall Management Center (FMC): Improper Restriction of Security Token Assignment
A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on (SSO) handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper ma
- 8.5 High severity
A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an…
A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the remote diagnostics debugger service. This vulnerability is due to an error when checking the privilege level of a user w
- 8.8 High severity
Cisco Nexus Dashboard: Improper Limitation of a Pathname to a Restricted Directory
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple int
- 8.8 High severity
Cisco Nexus Dashboard: Exposure of Sensitive Information to an Unauthorized Actor
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple int
- 8.6 High severity
Cisco Identity Services Engine Software: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain RADIUS r
- 8.8 High severity
Cisco Secure Firewall Management Center (FMC): Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account
- 7.5 High severity
Cisco Secure Firewall Management Center (FMC): Missing Authentication for Critical Functionality
A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space. This vulnerability exists because a critical API lacks authentication. An attacker co
- 7.7 High severity
Cisco Secure Firewall Management Center (FMC): Authorization Bypass Through User-Controlled Key
A vulnerability in a specific file download API of Cisco Secure FMC Software could allow an authenticated, remote attacker to download arbitrary files from an affected system. This vulnerability exists because user input is not being sanitized. An attacker cou
- 8.8 High severity
Cisco Secure Firewall Management Center (FMC): Deserialization of Untrusted Data
A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. This vulnerability is due to unsecured deserialization of web-management user-controlled data. An attacke
- 8.8 High severity
Cisco Secure Firewall Adaptive Security…: Improper Control of a Resource Through its Lifetime
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has cond
- 8.1 High severity
Cisco Secure Firewall Adaptive Security…: Incorrect Calculation
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has cond
- 8.4 High severity
Cisco Secure Firewall Adaptive Security…: Improper Adherence to Coding Standards
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has cond
- 8.8 High severity
Cisco Secure Firewall Adaptive Security…: Incorrect Comparison
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has cond
- 9.9 Critical severity
Cisco Secure Firewall Adaptive Security…: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has cond
- 8.3 High severity
Cisco Secure Firewall Management Center (FMC): Improper Certificate Validation
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to impersonate the peer device and obtain access at the level of the manager r
- 7.1 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is d
- 8.6 High severity
Cisco Secure Firewall Management Center (FMC): Memory Allocation with Excessive Size Value
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated, remote attacker to exhaust the available memory of an affected device. This vulnerability is due to i
- 9.1 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements in Data Query Logic
A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulne
- 8.6 High severity
Cisco Secure Firewall Adaptive Security…: Missing Release of Resource after Effective Lifetime
A vulnerability in Datagram TLS (DTLS) message handling of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Cisco Secure Firewall 3100 Series and 4200 Series devices could allow an una
- 8.6 High severity
Cisco Secure Firewall Adaptive Security…: Incorrect Type Conversion or Cast
A vulnerability in the certification authentication feature of Internet Key Exchange version 2 (IKEv2) for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthentica
- 7.5 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sendin
- 7.4 High severity
Cisco Secure Firewall Adaptive Security…: Missing Release of Memory after Effective Lifetime
A vulnerability in the EIGRP implementation in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to cause the device to reload unexpectedly
- 8.6 High severity
Cisco Secure Firewall Adaptive Security…: Loop with Unreachable Exit Condition
A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause h