107
CVEs
24
Critical
61
High
3
KEV
4
PoC
63
Unpatched C/H
23.4%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
24
HIGH
61
MEDIUM
22
LOW
0
Monthly CVE Trend
Affected Products (30)
Ios Xe
499
iOS
325
Adaptive Security Appliance Software
281
Nx Os
269
Firepower Threat Defense
225
Secure Firewall Management Center
180
Unified Communications Manager
173
Ios Xr
166
Identity Services Engine
149
Webex Meetings Server
133
Rv110W Firmware
132
Rv130W Firmware
131
Unified Computing System
102
Prime Infrastructure
80
Application Extension Platform
79
Rv215W Firmware
71
Wireless Lan Controller Software
68
Rv215W Wireless N Vpn Router Firmware
68
Anyconnect Secure Mobility Client
64
Web Security Appliance
64
Catalyst Sd Wan Manager
63
Rv130 Firmware
63
Webex Meetings
62
Rv130 Vpn Router Firmware
62
Unity Connection
57
Firepower Extensible Operating System
56
Webex Meetings Online
56
Data Center Network Manager
54
Open Redirect
51
Rv320 Firmware
51
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-76461 | We need answer as JSON only. Need synthesize. Need be careful with fields. Let's analyze input. CVE-2026-76461. Description: vulnerability in email parsing of Cisco AsyncOS for Cisco Secure Email Gateway allows unauthenticated remote attacker execute arbitrary commands root. Due insufficient validation email parsing logic. Attacker send crafted email containing malicious SQL statements through affected device. Success execute arbitrary SQL, leading to command execution root. CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-89 SQL injection. KEV yes active. POC publicly available. SSVC: exploitation none? conflicting? Actually input says SSVC Exploitation: none, Automatable yes, Technical impact total. But KEV yes active. This is a dataset inconsistency. Need compare signals. Maybe SSVC from CISA? It says exploitation none but KEV yes. Need state conflict explicitly in risk/confidence. But exploitation status phrase must be "confirmed actively exploited (CISA KEV)" because KEV=YES. Even though SSVC says none. Could note SSVC inconsistent in risk assessment / confidence. CPE: cpe:2.3:a:cisco:cisco_secure_email:*:*:*:*:*:*:*:* cpe shows all versions? Affected products from EUVD list many versions. Tags: SQLi, Cisco, Cisco Secure Email. References include Cisco advisory. Need use. Product name: "Cisco Secure Email Gateway" or "Cisco Secure Email"? product_name 1-3 words. The description says Cisco AsyncOS Software for Cisco Secure Email Gateway. Could choose "Cisco Secure Email Gateway" (4 words? Cisco Secure Email Gateway: 4 tokens. But "Cisco Secure Email" is 3 words and CPE product name. Product field examples. Use "Cisco Secure Email" maybe okay. But "specific product or service name" affected: Cisco Secure Email Gateway. That's 4 words. "1-3 words ONLY" — choose "Cisco Secure Email" (3 words). Maybe "Cisco AsyncOS" 2 words. But CPE is cisco_secure_email. Input tags include "Cisco Secure Email". Use "Cisco Secure Email". Need fields plain text string | CRITICAL | 9.8 | 2.2% | 124 |
KEV
PoC
No patch
|
| CVE-2026-20349 | Denial of service via crafted HTTP requests to the Remote Access SSL VPN service affects Cisco Secure Firewall ASA and FTD Software across a broad range of versions, enabling unauthenticated remote attackers to force an unexpected device reload and take down the firewall entirely. The Changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the VPN process itself to the entire device, disrupting all traffic passing through it. This vulnerability is confirmed actively exploited (CISA KEV), with SSVC marking it as automatable, making it a high-priority remediation target for any organization with internet-exposed ASA or FTD VPN endpoints. | HIGH | 8.6 | 1.0% | 119 |
KEV
PoC
No patch
|
| CVE-2026-20316 | Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote attacker to log in to the web interface using a built-in low-privileged account and access sensitive data. The flaw affects an extensive range of FMC versions from 7.0.0 through 10.0.1 and is rooted in CWE-259 (Use of Hard-coded Password). Cisco has self-elevated the Security Impact Rating to High - despite a CVSS 5.3 Medium score - explicitly because this credential foothold can be chained with other FMC vulnerabilities to escalate privileges, making the real-world risk materially higher than the base score implies. No public exploit or CISA KEV listing has been confirmed at time of analysis. | MEDIUM | 5.3 | 0.8% | 102 |
KEV
PoC
No patch
|
| CVE-2022-46292 | ### Summary A memory-safety vulnerability in Open Babel's MOPAC output parser allowed an out-of-bounds write into the `translationVectors[]` array when reading the "UNIT CELL TRANSLATION" block of a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available. | HIGH | 7.8 | 0.8% | 60 |
PoC
|
| CVE-2026-20357 | Authentication bypass in Cisco Crosswork Planning (versions 7.0.0 through 7.2.0) lets remote unauthenticated attackers reach a critical function that lacks authentication (CWE-306), yielding full confidentiality, integrity, and availability compromise (CVSS 10.0). The flaw was internally discovered by Cisco during a proactive security hardening review rather than external reporting, and there is no public exploit identified at time of analysis. Because scope is changed (S:C), successful exploitation can extend impact beyond the vulnerable component to other resources it manages. | CRITICAL | 10.0 | 0.5% | 50 |
No patch
|
| CVE-2026-20358 | External control of file system paths (CWE-73) in Cisco Crosswork Planning versions 7.0.0 through 7.2.0 allows a remote, unauthenticated attacker to influence file names or paths used by the application, yielding high integrity and availability impact with a scope change (CVSS 10.0). The flaw was discovered internally by Cisco during a proactive hardening review and disclosed as part of a bundled software hardening advisory; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because CVSS scope is Changed and privileges required is None, successful exploitation could affect components beyond the vulnerable module without authentication. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-20317 | Authentication bypass in Cisco Secure Workload (formerly Tetration) allows remote unauthenticated attackers to compromise integrity and availability across a security scope boundary. The flaw, one of several found during a Cisco engineering-team internal security review and grouped under CWE-287 (improper authentication), carries a maximum CVSS 10.0 score driven by network reach, no privileges, and a changed scope (S:C). No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS and unauthenticated network vector make it a high-priority patch. | CRITICAL | 10.0 | 0.3% | 50 |
No patch
|
| CVE-2026-20315 | Authentication bypass in Cisco Secure Workload (formerly Tetration) lets a remote, unauthenticated attacker circumvent access-control checks and fully compromise the platform, reflected in a maximal CVSS 3.1 base score of 10.0 with a scope change. The flaw is one of multiple improper access-control weaknesses (CWE-284) fixed in a Cisco internal software-hardening release spanning affected builds from the 1.x line through 4.0.x. It was discovered internally by Cisco engineering; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 10.0 | 0.3% | 50 |
No patch
|
| CVE-2026-20030 | SQL injection in Cisco Crosswork Planning (versions 7.0.0 through 7.2.0) lets a remote attacker inject arbitrary SQL commands, per Cisco's maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The flaw was found during an internal Cisco security-hardening review and addressed in a consolidated hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Cisco's vector indicates full compromise of confidentiality, integrity, and availability with a scope change, meaning impact may extend beyond the database component itself. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-20231 | Privilege escalation and cross-tenant compromise in Cisco Secure Workload (formerly Tetration) arises from improper neutralization of special elements (CWE-74 injection class), allowing a low-privileged authenticated user to inject crafted input that breaks the application security boundary. Because the CVSS scope is changed (S:C) with full confidentiality, integrity, and availability impact, an attacker with limited access can affect components beyond their authorized scope. The issue was found internally by Cisco during a hardening review and is addressed in a consolidated software hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.4% | 50 |
No patch
|
| CVE-2026-20303 | Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller stems from improper input validation (CWE-20) discovered during Cisco's internal hardening review; an authenticated attacker with low privileges can send crafted input over the network to break out of their intended authorization scope and compromise the confidentiality, integrity, and availability of the management plane. The CVSS 9.9 score is driven by a scope change (S:C), meaning impact extends beyond the vulnerable component to the broader SD-WAN control fabric it orchestrates. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the near-maximal CVSS and the centrality of the affected controllers make this a high-priority patch. | CRITICAL | 9.9 | 0.3% | 50 |
No patch
|
| CVE-2026-20359 | Credential exposure in Cisco Crosswork Planning (versions 7.0.0 through 7.2.0) allows a low-privileged authenticated attacker to retrieve insufficiently protected credentials and reuse them to compromise other systems or components. Disclosed by Cisco itself as part of an internal security-hardening review, the flaw carries a critical 9.9 CVSS score driven by a scope change (S:C) that lets stolen credentials extend the attacker's reach beyond the vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed. | CRITICAL | 9.9 | 0.3% | 50 |
No patch
|
| CVE-2026-20304 | Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a low-privileged, remote authenticated attacker to abuse improper access-control checks (CWE-284) to reach functionality or data intended for higher-privileged roles, with full confidentiality, integrity, and availability impact (CVSS 9.9, scope changed). The flaw was discovered internally by Cisco during a proactive hardening review and shipped as part of a consolidated software-hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SD-WAN Manager is the central orchestration plane for an entire SD-WAN fabric, successful abuse can cascade beyond the compromised component to the managed network. | CRITICAL | 9.9 | 0.3% | 50 |
No patch
|
| CVE-2026-20274 | Improper resource lifecycle control (CWE-664) in Cisco IOS XR Software is addressed by a batch software-hardening release stemming from Cisco's internal security review (advisory cisco-sa-hardening-iosxr-qg64NcM). The provided CVSS vector (AV:N/AC:L/PR:N/UI:N, 9.8) implies a remotely reachable, unauthenticated flaw with high confidentiality, integrity, and availability impact on IOS XR routers, but Cisco's omnibus advisory publishes no technical specifics on the affected component or trigger. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied. | CRITICAL | 9.8 | 0.7% | 50 |
No patch
|
| CVE-2026-20272 | Improper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthenticated attackers to compromise the confidentiality, integrity, and availability of affected network devices, per Cisco's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical). The flaw was found during an internal Cisco security review and fixed via software hardening releases; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the disclosure is a bundled hardening advisory, the exact injection sink and affected feature/protocol are not specified, so the concrete attack surface is not confirmed from available data. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|