Cisco vulnerabilities
We track 810 vulnerabilities in Cisco products across 60+ products. 790 are rated high or critical, and 106 have been exploited in real attacks. The most recent was published on November 4, 2026.
Latest Cisco vulnerabilities
- 9.9 Critical severity
Cisco Crosswork Planning: Insufficiently Protected Credentials
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internall
- 10.0 Critical severity
Cisco Crosswork Planning: External Control of File Name or Path
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internall
- 10.0 Critical severity
Cisco Crosswork Planning: Missing Authentication for Critical Functionality
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internall
- 7.5 High severity
Cisco BroadWorks Improper Restriction of XML External Entity Reference Exploited
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly pa
- 7.5 High severity
Cisco Secure Workload: Improper Restriction of Operations within the Bounds of a Memory Buffer
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple int
- 9.6 Critical severity
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco…
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple int
- 10.0 Critical severity
Cisco Secure Workload: Improper Authentication
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple int
- 10.0 Critical severity
Cisco Secure Workload: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple int
- 9.9 Critical severity
Cisco Secure Workload: Improper Neutralization of Special Elements in Output Used by a Downstream Component
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple int
- 10.0 Critical severity
Cisco Crosswork Planning: Improper Neutralization of Special Elements used in an SQL Command
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internall
- 8.6 High severity
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Exploited
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unex
- 7.5 High severity
Cisco Secure Endpoint: Buffer Copy without Checking Size of Input
A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improp
- 7.5 High severity
Cisco Secure Endpoint: Out-of-bounds Read
A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to imp
- 7.5 High severity
Cisco Secure Endpoint: Out-of-bounds Read
A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improp
- 7.5 High severity
Cisco Secure Endpoint: Stack-based Buffer Overflow
A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improp
- 7.5 High severity
Cisco Secure Endpoint: Integer Overflow or Wraparound
A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to imp
- 7.5 High severity
Cisco Secure Endpoint: Double Free
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An a
- 7.5 High severity
Cisco Secure Endpoint: Buffer Copy without Checking Size of Input
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result
- 7.7 High severity
Cisco Catalyst SD-WAN Controller: Improper Validation of Specified Quantity in Input
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple intern
- 8.8 High severity
Cisco Catalyst SD-WAN Controller: Cleartext Storage of Sensitive Information
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple intern
- 9.1 Critical severity
Cisco Catalyst SD-WAN Controller: Improper Link Resolution Before File Access
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple intern
- 9.9 Critical severity
Cisco Catalyst SD-WAN Controller: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that address multiple inter
- 9.9 Critical severity
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco…
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple intern
- 8.6 High severity
Cisco IOS XE Software: Unchecked Input for Loop Condition
A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition o
- 8.6 High severity
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS…
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple int
- 9.8 Critical severity
Cisco IOS XE Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple intern
- 8.6 High severity
Cisco IOS XE Software: Insufficient Control Flow Management
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple intern
- 8.6 High severity
Cisco IOS XE Software: Incorrect Calculation
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple intern
- 8.6 High severity
Cisco IOS XE Software: Improper Control of a Resource Through its Lifetime
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple intern
- 8.6 High severity
Cisco IOS XE Software: Improper Restriction of Operations within the Bounds of a Memory Buffer
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple intern
- 9.0 Critical severity
Cisco IOS XE Software: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple intern
- 8.6 High severity
A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE…
A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handlin
- 8.8 High severity
Cisco Unified Computing System (Standalone): Improper Neutralization of Parameter/Argument Delimiters
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. Th
- 7.7 High severity
Cisco IOS XE Software: Missing Release of Resource after Effective Lifetime
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due
- 5.3 Medium severity
Cisco Secure Firewall Management Center Use of Hard-coded Password Exploited
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
- 7.5 High severity
Cisco RoomOS Software: Improper Check or Handling of Exceptional Conditions
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d
- 7.5 High severity
Cisco RoomOS Software: Improper Control of a Resource Through its Lifetime
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d
- 9.8 Critical severity
Cisco RoomOS Software: Missing Encryption of Sensitive Data
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d
- 9.8 Critical severity
Cisco RoomOS Software: Improper Restriction of Operations within the Bounds of a Memory Buffer
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d
- 7.5 High severity
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco…
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d