Cisco vulnerabilities
We track 810 vulnerabilities in Cisco products across 60+ products. 790 are rated high or critical, and 106 have been exploited in real attacks. The most recent was published on November 4, 2026.
Latest Cisco vulnerabilities
- 8.6 High severity
Cisco Secure Firewall Threat Defense (FTD)…: Double Free
A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vuln
- 10.0 Critical severity
Cisco Identity Services Engine Software: Authentication Bypass by Spoofing
A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorizat
- 8.8 High severity
Cisco Nexus Dashboard: Improper Neutralization of Special Elements used in an SQL Command
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple int
- 9.1 Critical severity
Cisco Secure Firewall Management Center (FMC): Deserialization of Untrusted Data
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software could allow an authenticated, remote attacker to obtain root privileges. This vulnerability is due to unsecured deserialization of untrusted data over the sft
- 9.9 Critical severity
Cisco Secure Firewall Adaptive Security…: Improper Neutralization
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has cond
- 9.9 Critical severity
Cisco Secure Firewall Adaptive Security…: Improper Check or Handling of Exceptional Conditions
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has cond
- 9.8 Critical severity
Cisco Nexus Dashboard: Missing Authentication for Critical Functionality
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple int
- 9.9 Critical severity
Cisco Nexus Dashboard: Improper Neutralization of Special Elements used in a Command
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multipl
- 9.9 Critical severity
Cisco Secure Firewall Management Center (FMC): Missing Authorization
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands as root. This vulnerability exists because a registered sf
- 9.9 Critical severity
Cisco Nexus Dashboard: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multipl
- 9.8 Critical severity
Cisco Secure Firewall Management Center (FMC): Deserialization of Untrusted Data
A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to ins
- 9.1 Critical severity
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco…
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review
- 9.1 Critical severity
Cisco Identity Services Engine Software: Deserialization of Untrusted Data
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid high-privileged administrative creden
- 9.1 Critical severity
Cisco Identity Services Engine Software: Incorrect Resource Transfer Between Spheres
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review
- 10.0 Critical severity
Cisco Identity Services Engine Software: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review
- 9.1 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in a Command
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid high-privileged administrative creden
- 10.0 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review
- 9.0 Critical severity
Cisco Secure Firewall Management Center (FMC): Improper Authorization
A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. This vulnerability is due to incorrect initialization of
- 9.6 Critical severity
Cisco Secure Firewall Adaptive Security…: Protection Mechanism Failure
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has cond
- 9.9 Critical severity
Cisco Identity Services Engine Software: Deserialization of Untrusted Data
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at le
- 9.1 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have
- 9.1 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attac
- 9.9 Critical severity
Cisco Identity Services Engine Software: Insufficiently Protected Credentials
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review
- 9.8 Critical severity
Cisco Secure Email Gateway SQL Injection Exploited
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to in
- 9.8 Critical severity
Cisco Secure Email: Improper Neutralization
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software har
- 7.5 High severity
Cisco Secure Email: Improper Validation of Specified Quantity in Input
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software har
- 9.8 Critical severity
Cisco Secure Email and Web Manager: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software har
- 9.8 Critical severity
Cisco Secure Email: Relative Path Traversal
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software har
- 9.8 Critical severity
Cisco Secure Email: Improper Control of a Resource Through its Lifetime
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software har
- 7.1 High severity
Cisco Enterprise NFV Infrastructure Software: Exposed Dangerous Method or Function
A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an una
- 7.5 High severity
Cisco Session Initiation Protocol (SIP) Software: Missing Release of Memory after Effective Lifetime
A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS
- 8.8 High severity
Cisco IOS XR Software: Improper Check or Handling of Exceptional Conditions
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple
- 9.8 Critical severity
Cisco IOS XR Software: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple inte
- 8.8 High severity
Cisco IOS XR Software: Improper Neutralization
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple inte
- 8.2 High severity
Cisco IOS XR Software: Protection Mechanism Failure
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple inte
- 8.6 High severity
Cisco IOS XR Software: Insufficient Control Flow Management
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple inte
- 8.8 High severity
Cisco IOS XR Software: Incorrect Calculation
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple inte
- 9.8 Critical severity
Cisco IOS XR Software: Improper Control of a Resource Through its Lifetime
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple inte
- 9.8 Critical severity
Cisco NX-OS Software: Binding to an Unrestricted IP Address
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the def
- 8.8 High severity
Cisco Talos Intelligence for Enterprise…: Server-Side Request Forgery
In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the get_talos_enrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer (REST) API endpo