37
CVEs
16
Critical
11
High
1
KEV
1
PoC
26
Unpatched C/H
10.8%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
16
HIGH
11
MEDIUM
10
LOW
0
Monthly CVE Trend
Affected Products (30)
Ios Xe
499
iOS
325
Adaptive Security Appliance Software
281
Nx Os
269
Firepower Threat Defense
225
Secure Firewall Management Center
180
Unified Communications Manager
173
Ios Xr
166
Identity Services Engine
149
Webex Meetings Server
133
Rv110W Firmware
132
Rv130W Firmware
131
Unified Computing System
102
Prime Infrastructure
80
Application Extension Platform
79
Rv215W Firmware
71
Wireless Lan Controller Software
68
Rv215W Wireless N Vpn Router Firmware
68
Anyconnect Secure Mobility Client
64
Web Security Appliance
64
Catalyst Sd Wan Manager
63
Rv130 Firmware
63
Webex Meetings
62
Rv130 Vpn Router Firmware
62
Unity Connection
57
Firepower Extensible Operating System
56
Webex Meetings Online
56
Data Center Network Manager
54
Open Redirect
51
Rv320 Firmware
51
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-76461 | We need answer as JSON only. Need synthesize. Need be careful with fields. Let's analyze input. CVE-2026-76461. Description: vulnerability in email parsing of Cisco AsyncOS for Cisco Secure Email Gateway allows unauthenticated remote attacker execute arbitrary commands root. Due insufficient validation email parsing logic. Attacker send crafted email containing malicious SQL statements through affected device. Success execute arbitrary SQL, leading to command execution root. CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-89 SQL injection. KEV yes active. POC publicly available. SSVC: exploitation none? conflicting? Actually input says SSVC Exploitation: none, Automatable yes, Technical impact total. But KEV yes active. This is a dataset inconsistency. Need compare signals. Maybe SSVC from CISA? It says exploitation none but KEV yes. Need state conflict explicitly in risk/confidence. But exploitation status phrase must be "confirmed actively exploited (CISA KEV)" because KEV=YES. Even though SSVC says none. Could note SSVC inconsistent in risk assessment / confidence. CPE: cpe:2.3:a:cisco:cisco_secure_email:*:*:*:*:*:*:*:* cpe shows all versions? Affected products from EUVD list many versions. Tags: SQLi, Cisco, Cisco Secure Email. References include Cisco advisory. Need use. Product name: "Cisco Secure Email Gateway" or "Cisco Secure Email"? product_name 1-3 words. The description says Cisco AsyncOS Software for Cisco Secure Email Gateway. Could choose "Cisco Secure Email Gateway" (4 words? Cisco Secure Email Gateway: 4 tokens. But "Cisco Secure Email" is 3 words and CPE product name. Product field examples. Use "Cisco Secure Email" maybe okay. But "specific product or service name" affected: Cisco Secure Email Gateway. That's 4 words. "1-3 words ONLY" — choose "Cisco Secure Email" (3 words). Maybe "Cisco AsyncOS" 2 words. But CPE is cisco_secure_email. Input tags include "Cisco Secure Email". Use "Cisco Secure Email". Need fields plain text string | CRITICAL | 9.8 | 2.2% | 126 |
KEV
PoC
No patch
|
| CVE-2026-20357 | Authentication bypass in Cisco Crosswork Planning (versions 7.0.0 through 7.2.0) lets remote unauthenticated attackers reach a critical function that lacks authentication (CWE-306), yielding full confidentiality, integrity, and availability compromise (CVSS 10.0). The flaw was internally discovered by Cisco during a proactive security hardening review rather than external reporting, and there is no public exploit identified at time of analysis. Because scope is changed (S:C), successful exploitation can extend impact beyond the vulnerable component to other resources it manages. | CRITICAL | 10.0 | 0.5% | 50 |
No patch
|
| CVE-2026-20358 | External control of file system paths (CWE-73) in Cisco Crosswork Planning versions 7.0.0 through 7.2.0 allows a remote, unauthenticated attacker to influence file names or paths used by the application, yielding high integrity and availability impact with a scope change (CVSS 10.0). The flaw was discovered internally by Cisco during a proactive hardening review and disclosed as part of a bundled software hardening advisory; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because CVSS scope is Changed and privileges required is None, successful exploitation could affect components beyond the vulnerable module without authentication. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-20317 | Authentication bypass in Cisco Secure Workload (formerly Tetration) allows remote unauthenticated attackers to compromise integrity and availability across a security scope boundary. The flaw, one of several found during a Cisco engineering-team internal security review and grouped under CWE-287 (improper authentication), carries a maximum CVSS 10.0 score driven by network reach, no privileges, and a changed scope (S:C). No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS and unauthenticated network vector make it a high-priority patch. | CRITICAL | 10.0 | 0.3% | 50 |
No patch
|
| CVE-2026-20315 | Authentication bypass in Cisco Secure Workload (formerly Tetration) lets a remote, unauthenticated attacker circumvent access-control checks and fully compromise the platform, reflected in a maximal CVSS 3.1 base score of 10.0 with a scope change. The flaw is one of multiple improper access-control weaknesses (CWE-284) fixed in a Cisco internal software-hardening release spanning affected builds from the 1.x line through 4.0.x. It was discovered internally by Cisco engineering; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 10.0 | 0.3% | 50 |
No patch
|
| CVE-2026-20030 | SQL injection in Cisco Crosswork Planning (versions 7.0.0 through 7.2.0) lets a remote attacker inject arbitrary SQL commands, per Cisco's maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The flaw was found during an internal Cisco security-hardening review and addressed in a consolidated hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Cisco's vector indicates full compromise of confidentiality, integrity, and availability with a scope change, meaning impact may extend beyond the database component itself. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-20231 | Privilege escalation and cross-tenant compromise in Cisco Secure Workload (formerly Tetration) arises from improper neutralization of special elements (CWE-74 injection class), allowing a low-privileged authenticated user to inject crafted input that breaks the application security boundary. Because the CVSS scope is changed (S:C) with full confidentiality, integrity, and availability impact, an attacker with limited access can affect components beyond their authorized scope. The issue was found internally by Cisco during a hardening review and is addressed in a consolidated software hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.4% | 50 |
No patch
|
| CVE-2026-20359 | Credential exposure in Cisco Crosswork Planning (versions 7.0.0 through 7.2.0) allows a low-privileged authenticated attacker to retrieve insufficiently protected credentials and reuse them to compromise other systems or components. Disclosed by Cisco itself as part of an internal security-hardening review, the flaw carries a critical 9.9 CVSS score driven by a scope change (S:C) that lets stolen credentials extend the attacker's reach beyond the vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed. | CRITICAL | 9.9 | 0.3% | 50 |
No patch
|
| CVE-2026-20274 | Improper resource lifecycle control (CWE-664) in Cisco IOS XR Software is addressed by a batch software-hardening release stemming from Cisco's internal security review (advisory cisco-sa-hardening-iosxr-qg64NcM). The provided CVSS vector (AV:N/AC:L/PR:N/UI:N, 9.8) implies a remotely reachable, unauthenticated flaw with high confidentiality, integrity, and availability impact on IOS XR routers, but Cisco's omnibus advisory publishes no technical specifics on the affected component or trigger. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied. | CRITICAL | 9.8 | 0.7% | 50 |
No patch
|
| CVE-2026-76441 | We need answer as JSON only. Need comply. We need synthesize. Need be careful with product_name 1-3 words. The CVE affects Cisco Secure Email Gateway and Cisco Secure Email and Web Manager? Description says both. Product_name primary could be "Cisco Secure Email" or "Cisco Secure Email and Web Manager". We should pick primary. CPE only cisco_secure_email_and_web_manager. Tags include Cisco Secure Email And Web Manager. Product_name maybe "Cisco Secure Email and Web Manager" 5 words? Need 1-3 words ONLY. Could use "Cisco Secure Email" (3 words) but ambiguity. "Secure Email Gateway" maybe 3. Since CPE only Web Manager, "Cisco Secure Email and Web Manager" too many. Use "Cisco Secure Email" maybe. But vulnerable product spans Gateway and Manager. user says 1-3 words, specific product. "Cisco Secure Email" three words. But the affected product in CPE is Secure Email and Web Manager. Maybe "Cisco Secure Email" okay. "Cisco Email Security" maybe. The official product names: Cisco Secure Email Gateway, Cisco Secure Email and Web Manager. Both under "Cisco Secure Email". I'll use "Cisco Secure Email". Summary: Need original synthesis, no copy. Mention vulnerabilities related to improper access control, product versions, maybe unauthenticated remote? Given CVSS says PR:N. Not KEV. POC not mentioned. EPSS not given. We can say no public exploit identified. Need mention CVSS 9.8. "Improper access control in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager allows remote unauthenticated attackers to..." The description doesn't specify exact impact beyond CWE-284. CVSS C/I/A high. We should not invent specifics like "execute arbitrary code" because CWE-284 access control; CVSS H/H/H but impact unknown. Better state "potentially bypass access controls to affect confidentiality, integrity, and availability" but that mirrors CVSS. Need plain language. Could say "Improper access control in Cisco Secure Email Gateway and Secure Email and Web Manager allows remote una | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2026-76440 | We need answer only valid JSON. Need synthesize. Need understand CVE details. We need populate fields. Need be careful rules. Let's inspect input. CVE-2026-76440: Cisco Secure Email Gateway and Cisco Secure Email and Web Manager internally discovered vulnerabilities grouped CWE-23 path traversal. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS 0.43% percentile 36. KEV? Not provided in input, so no. POC? no explicit. Tags Path Traversal, Cisco, Cisco Secure Email, Cisco Secure Email And Web Manager. SSVC exploitation none, automatable yes, technical impact total. EUVD affected versions lots. References include Cisco advisory cisco-sa-hardening-esa-dfCrfXkm, NVD, cve.org blog weird. Need patch availability? Input doesn't include explicit patch data but reference Cisco advisory. We need not invent exact fix versions. Description says "software hardening releases that address multiple internally discovered vulnerabilities" so patch available per vendor advisory. Need maybe exact fix versions not listed. Affected versions all listed but no fixed versions. Need state vendor-released patch available; exact version not independently confirmed from data? Remediation cite advisory. We need be careful: The advisory URL likely contains patch info but input did not include fixed version. The editorial says if patch refs point to advisory no version: "Patch available per vendor advisory". Use that. Need write all fields plain strings. Need not copy description. Product name: "Cisco Secure Email" or "Cisco Secure Email and Web Manager". Since primary? It mentions two products. Pick primary maybe "Cisco Secure Email" but affected includes both. Product_name 1-3 words: "Cisco Secure Email" likely. But maybe "Cisco Secure Email Gateway"? Description says Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Product name should specific. "Cisco Secure Email Gateway" is 4 words? Actually 4? Cisco Secure Email Gateway = 4 words. "Cisco Secure Email" 3. Use "Cisco Secur | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-20353 | We need answer as JSON only. Need synthesize. Need be careful. Let's analyze input. CVE-2026-20353. Description generic internal review hardening releases addressing multiple internally discovered vulnerabilities. Vulnerabilities tracked by CVE related to issues with improper control of a resource through lifetime CWE-664. CVSS 9.8 network low no priv no interaction, total CIA. CPE cisco:cisco_secure_email:*:*:*:*:*:*:*:* (no version?). Tags: Information Disclosure, Cisco, Cisco Secure Email. SSVC exploitation none, automatable yes, impact total. EUVD affected versions list. Need output fields. Need follow precision rules. Product_name: "Cisco Secure Email" perhaps includes Gateway and Email and Web Manager? Description mentions Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. The tags "Cisco Secure Email". CPE product cisco_secure_email. Product name should be 1-3 words. "Cisco Secure Email" okay. But maybe primary affected product specifically Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Product_name could "Cisco Secure Email". Need maybe "Cisco Secure Email" because CPE. Summary: original synthesis, not copy description. Need mention vulnerability type maybe improper resource lifetime control. Impact perhaps information disclosure? CVSS says CIA high total but CWE 664 could be memory/resource issues. Need mention affected versions. KEV? Not provided. So no public exploit? We need infer from SSVC exploitation none, no KEV, no POC. Should state not actively exploited, no public POC identified. EPSS? Not provided. "EPSS risk if notable" — no EPSS data, say EPSS not provided. Need exact phrase? "currently no evidence of active exploitation in CISA KEV; SSVC exploitation none; no POC identified at time of analysis." Summary: "Multiple resource-lifetime handling flaws in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager allow unauthenticated remote attackers to fully compromise affected appliances through networ | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-76443 | We need answer as JSON only. Need synthesize. Need be careful with fields. Need analyze data. We have CVE-2026-76443. Description vague: Cisco Secure Email Gateway? It says Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Multiple internally discovered vulnerabilities. Improper neutralization CWE-707. CVSS 9.8 network no auth. CPE cisco secure email and secure email and web manager. Affected versions huge. Reference Cisco advisory sec.cloudapps. Tags Information Disclosure, Cisco, Cisco Secure Email, Cisco Secure Email And Web Manager. EPSS 0.37 percentile 30. SSVC exploitation none, automatable yes, technical impact total. EUVD. Need product_name: 1-3 words. Could be "Cisco Secure Email" or "Cisco Secure Email and Web Manager"? They mention both. Primary maybe "Cisco Secure Email". But CPE also both. Need one. "Cisco Secure Email" specific product. Product_name only 1-3 words, "Cisco Secure Email" is 3. Maybe include "Cisco Secure Email and Web Manager" is 6? Could be "Cisco Secure Email" since vuln tracked? But title says Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. We choose "Cisco Secure Email". Summary: 2-3 sentences original. Needs not copy description. Start with specific impact verb. Need mention what vulnerability, affected product versions, attacker can do. Active exploitation? KEV no. POC? no data. EPSS low 0.37. CVSS critical. Write: "Improper neutralization of input in Cisco Secure Email and Cisco Secure Email and Web Manager allows unauthenticated remote attackers to achieve full compromise (confidentiality, integrity, availability) on affected appliances. The advisory covers multiple internally discovered hardening issues grouped under CWE-707 with CVSS 9.8. No public exploit or active exploitation identified at time of analysis; EPSS is low at 0.37%, suggesting limited current exploitation likelihood despite high severity." That's maybe. Technical_context: underlying tech/protocol? CWE-707 is "Improper Neut | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-20279 | Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restrictions and gain full compromise of affected routing platforms, per Cisco's CVSS 9.8 rating. The flaw is one of several internally discovered issues addressed in a batch of software-hardening releases from Cisco's proactive security review (advisory cisco-sa-hardening-iosxr-qg64NcM). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-supplied description is high-level boilerplate with no concrete technical detail. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-20212 | Remote code execution in the Silicon One integration of Cisco Nexus 9000 Series Switches (Cisco NX-OS Software) lets an unauthenticated attacker run code as root by connecting to TCP ports 43210 and 43211, which are exposed by default in the Layer 3 default VRF. Crafted input to the S1HAL process is executed with root privileges, and the same flaw can crash S1HAL to force a device reload (denial of service). Rated CVSS 9.8; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-authentication, network-facing nature makes it a top-priority patch. | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|