37
CVEs
16
Critical
11
High
1
KEV
1
PoC
26
Unpatched C/H
10.8%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
16
HIGH
11
MEDIUM
10
LOW
0
Monthly CVE Trend
Affected Products (30)
Ios Xe
499
iOS
325
Adaptive Security Appliance Software
281
Nx Os
269
Firepower Threat Defense
225
Secure Firewall Management Center
180
Unified Communications Manager
173
Ios Xr
166
Identity Services Engine
149
Webex Meetings Server
133
Rv110W Firmware
132
Rv130W Firmware
131
Unified Computing System
102
Prime Infrastructure
80
Application Extension Platform
79
Rv215W Firmware
71
Wireless Lan Controller Software
68
Rv215W Wireless N Vpn Router Firmware
68
Anyconnect Secure Mobility Client
64
Web Security Appliance
64
Catalyst Sd Wan Manager
63
Rv130 Firmware
63
Webex Meetings
62
Rv130 Vpn Router Firmware
62
Unity Connection
57
Firepower Extensible Operating System
56
Webex Meetings Online
56
Data Center Network Manager
54
Open Redirect
51
Rv320 Firmware
51
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-76461 | We need answer as JSON only. Need synthesize. Need be careful with fields. Let's analyze input. CVE-2026-76461. Description: vulnerability in email parsing of Cisco AsyncOS for Cisco Secure Email Gateway allows unauthenticated remote attacker execute arbitrary commands root. Due insufficient validation email parsing logic. Attacker send crafted email containing malicious SQL statements through affected device. Success execute arbitrary SQL, leading to command execution root. CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-89 SQL injection. KEV yes active. POC publicly available. SSVC: exploitation none? conflicting? Actually input says SSVC Exploitation: none, Automatable yes, Technical impact total. But KEV yes active. This is a dataset inconsistency. Need compare signals. Maybe SSVC from CISA? It says exploitation none but KEV yes. Need state conflict explicitly in risk/confidence. But exploitation status phrase must be "confirmed actively exploited (CISA KEV)" because KEV=YES. Even though SSVC says none. Could note SSVC inconsistent in risk assessment / confidence. CPE: cpe:2.3:a:cisco:cisco_secure_email:*:*:*:*:*:*:*:* cpe shows all versions? Affected products from EUVD list many versions. Tags: SQLi, Cisco, Cisco Secure Email. References include Cisco advisory. Need use. Product name: "Cisco Secure Email Gateway" or "Cisco Secure Email"? product_name 1-3 words. The description says Cisco AsyncOS Software for Cisco Secure Email Gateway. Could choose "Cisco Secure Email Gateway" (4 words? Cisco Secure Email Gateway: 4 tokens. But "Cisco Secure Email" is 3 words and CPE product name. Product field examples. Use "Cisco Secure Email" maybe okay. But "specific product or service name" affected: Cisco Secure Email Gateway. That's 4 words. "1-3 words ONLY" — choose "Cisco Secure Email" (3 words). Maybe "Cisco AsyncOS" 2 words. But CPE is cisco_secure_email. Input tags include "Cisco Secure Email". Use "Cisco Secure Email". Need fields plain text string | CRITICAL | 9.8 | 2.2% | 126 |
KEV
PoC
No patch
|
| CVE-2026-20357 | Authentication bypass in Cisco Crosswork Planning (versions 7.0.0 through 7.2.0) lets remote unauthenticated attackers reach a critical function that lacks authentication (CWE-306), yielding full confidentiality, integrity, and availability compromise (CVSS 10.0). The flaw was internally discovered by Cisco during a proactive security hardening review rather than external reporting, and there is no public exploit identified at time of analysis. Because scope is changed (S:C), successful exploitation can extend impact beyond the vulnerable component to other resources it manages. | CRITICAL | 10.0 | 0.5% | 50 |
No patch
|
| CVE-2026-20358 | External control of file system paths (CWE-73) in Cisco Crosswork Planning versions 7.0.0 through 7.2.0 allows a remote, unauthenticated attacker to influence file names or paths used by the application, yielding high integrity and availability impact with a scope change (CVSS 10.0). The flaw was discovered internally by Cisco during a proactive hardening review and disclosed as part of a bundled software hardening advisory; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because CVSS scope is Changed and privileges required is None, successful exploitation could affect components beyond the vulnerable module without authentication. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-20317 | Authentication bypass in Cisco Secure Workload (formerly Tetration) allows remote unauthenticated attackers to compromise integrity and availability across a security scope boundary. The flaw, one of several found during a Cisco engineering-team internal security review and grouped under CWE-287 (improper authentication), carries a maximum CVSS 10.0 score driven by network reach, no privileges, and a changed scope (S:C). No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS and unauthenticated network vector make it a high-priority patch. | CRITICAL | 10.0 | 0.3% | 50 |
No patch
|
| CVE-2026-20315 | Authentication bypass in Cisco Secure Workload (formerly Tetration) lets a remote, unauthenticated attacker circumvent access-control checks and fully compromise the platform, reflected in a maximal CVSS 3.1 base score of 10.0 with a scope change. The flaw is one of multiple improper access-control weaknesses (CWE-284) fixed in a Cisco internal software-hardening release spanning affected builds from the 1.x line through 4.0.x. It was discovered internally by Cisco engineering; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 10.0 | 0.3% | 50 |
No patch
|
| CVE-2026-20030 | SQL injection in Cisco Crosswork Planning (versions 7.0.0 through 7.2.0) lets a remote attacker inject arbitrary SQL commands, per Cisco's maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The flaw was found during an internal Cisco security-hardening review and addressed in a consolidated hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Cisco's vector indicates full compromise of confidentiality, integrity, and availability with a scope change, meaning impact may extend beyond the database component itself. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-20231 | Privilege escalation and cross-tenant compromise in Cisco Secure Workload (formerly Tetration) arises from improper neutralization of special elements (CWE-74 injection class), allowing a low-privileged authenticated user to inject crafted input that breaks the application security boundary. Because the CVSS scope is changed (S:C) with full confidentiality, integrity, and availability impact, an attacker with limited access can affect components beyond their authorized scope. The issue was found internally by Cisco during a hardening review and is addressed in a consolidated software hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.4% | 50 |
No patch
|
| CVE-2026-20359 | Credential exposure in Cisco Crosswork Planning (versions 7.0.0 through 7.2.0) allows a low-privileged authenticated attacker to retrieve insufficiently protected credentials and reuse them to compromise other systems or components. Disclosed by Cisco itself as part of an internal security-hardening review, the flaw carries a critical 9.9 CVSS score driven by a scope change (S:C) that lets stolen credentials extend the attacker's reach beyond the vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed. | CRITICAL | 9.9 | 0.3% | 50 |
No patch
|
| CVE-2026-20274 | Improper resource lifecycle control (CWE-664) in Cisco IOS XR Software is addressed by a batch software-hardening release stemming from Cisco's internal security review (advisory cisco-sa-hardening-iosxr-qg64NcM). The provided CVSS vector (AV:N/AC:L/PR:N/UI:N, 9.8) implies a remotely reachable, unauthenticated flaw with high confidentiality, integrity, and availability impact on IOS XR routers, but Cisco's omnibus advisory publishes no technical specifics on the affected component or trigger. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied. | CRITICAL | 9.8 | 0.7% | 50 |
No patch
|
| CVE-2026-20212 | Remote code execution in the Silicon One integration of Cisco Nexus 9000 Series Switches (Cisco NX-OS Software) lets an unauthenticated attacker run code as root by connecting to TCP ports 43210 and 43211, which are exposed by default in the Layer 3 default VRF. Crafted input to the S1HAL process is executed with root privileges, and the same flaw can crash S1HAL to force a device reload (denial of service). Rated CVSS 9.8; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-authentication, network-facing nature makes it a top-priority patch. | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2026-20279 | Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restrictions and gain full compromise of affected routing platforms, per Cisco's CVSS 9.8 rating. The flaw is one of several internally discovered issues addressed in a batch of software-hardening releases from Cisco's proactive security review (advisory cisco-sa-hardening-iosxr-qg64NcM). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-supplied description is high-level boilerplate with no concrete technical detail. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-76443 | We need answer as JSON only. Need synthesize. Let's parse input. CVE-2026-76443. Description: Cisco internal security review, software hardening releases addressing multiple internally discovered vulnerabilities. Vulnerabilities tracked by CVE-2026-76443 related to improper neutralization grouped under CWE-707. CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-707. Reported by cisco. CPE: cisco secure email and web manager. Tags: Information Disclosure, Cisco, Cisco Secure Email, Cisco Secure Email And Web Manager. SSVC: exploitation none, automatable yes, technical impact total. ENISA EUVD ID. Affected versions list multiple. References: Cisco advisory cisco-sa-hardening-esa-dfCrfXkm and NVD link. Need produce fields. product_name: Cisco Secure Email Gateway? Description says Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Primary product maybe "Cisco Secure Email Gateway" or "Cisco Secure Email". CPE only cisco_secure_email and cisco_secure_email_and_web_manager. 1-3 words. "Cisco Secure Email" likely. But description covers Gateway and Manager. Choose "Cisco Secure Email". Could be "Cisco Secure Email Gateway". Need primary. Product_name "Cisco Secure Email Gateway" is 4? words: Cisco Secure Email Gateway = 4, but they said 1-3 words ONLY. "Cisco Secure Email" (3). Good. Summary: Need original synthesis. Mention multiple internally discovered improper neutralization vulnerabilities in Cisco Secure Email Gateway and Web Manager, CVSS 9.8, unauthenticated remote, information disclosure? Actually tags Information Disclosure but CVSS C/I/A high. Description vague. Not actively exploited, SSVC exploitation none, automatable yes. No POC info. No KEV. Mention "software hardening releases" but patch? Need include exact if available? Input affected versions, no fixed versions explicitly? Cisco advisory maybe no version. We can state patch available per vendor advisory; exact fixed versions not provided in data. Summary should say remote unauth | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-76441 | We need answer as JSON only. Need comply. We need synthesize. Need be careful with product_name 1-3 words. The CVE affects Cisco Secure Email Gateway and Cisco Secure Email and Web Manager? Description says both. Product_name primary could be "Cisco Secure Email" or "Cisco Secure Email and Web Manager". We should pick primary. CPE only cisco_secure_email_and_web_manager. Tags include Cisco Secure Email And Web Manager. Product_name maybe "Cisco Secure Email and Web Manager" 5 words? Need 1-3 words ONLY. Could use "Cisco Secure Email" (3 words) but ambiguity. "Secure Email Gateway" maybe 3. Since CPE only Web Manager, "Cisco Secure Email and Web Manager" too many. Use "Cisco Secure Email" maybe. But vulnerable product spans Gateway and Manager. user says 1-3 words, specific product. "Cisco Secure Email" three words. But the affected product in CPE is Secure Email and Web Manager. Maybe "Cisco Secure Email" okay. "Cisco Email Security" maybe. The official product names: Cisco Secure Email Gateway, Cisco Secure Email and Web Manager. Both under "Cisco Secure Email". I'll use "Cisco Secure Email". Summary: Need original synthesis, no copy. Mention vulnerabilities related to improper access control, product versions, maybe unauthenticated remote? Given CVSS says PR:N. Not KEV. POC not mentioned. EPSS not given. We can say no public exploit identified. Need mention CVSS 9.8. "Improper access control in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager allows remote unauthenticated attackers to..." The description doesn't specify exact impact beyond CWE-284. CVSS C/I/A high. We should not invent specifics like "execute arbitrary code" because CWE-284 access control; CVSS H/H/H but impact unknown. Better state "potentially bypass access controls to affect confidentiality, integrity, and availability" but that mirrors CVSS. Need plain language. Could say "Improper access control in Cisco Secure Email Gateway and Secure Email and Web Manager allows remote una | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2026-76440 | We need answer only JSON object per user. Need synthesize. Let's parse input. CVE-2026-76440. Description: Cisco Secure Email Gateway and Cisco Secure Email and Web Manager internal security review, hardening releases address multiple internally discovered vulnerabilities. Vulnerabilities tracked by CVE related to path traversal issues grouped under CWE Pillar CWE-23. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-23. Reported cisco. CPE cisco secure email and cisco secure email and web manager. Tags path traversal Cisco etc. SSVC exploitation none, automatable yes, technical impact total. ENISA EUVD. Affected versions long list. References Cisco advisory and NVD. Need produce fields. product_name: "Cisco Secure Email Gateway" maybe specific product? Input references Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Need primary product. Could say "Cisco Secure Email Gateway" or "Cisco Secure Email". Product name 1-3 words. Use "Cisco Secure Email" maybe affected product includes Web Manager. But description says Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Primary "Cisco Secure Email". Need 1-3 words only; "Cisco Secure Email" 3 words. Good. Summary: original synthesis, not copy. Must mention path traversal, remote unauthenticated? CVSS PR:N. Affected versions. CVSS 9.8. KEV? Input does not include KEV field. So no active exploitation. POC? Not provided. EPSS not provided. We can say no public exploit identified at time of analysis? Need use only phrase if neither KEV/POC: "no public exploit identified at time of analysis." KEV absent, POC absent. Need not invent. Summary start with specific impact verb and product. Start "Path traversal in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager allows unauthenticated remote attackers to..." Mention internal review, multiple vulnerabilities. CWE-23. Attackers can possibly read/write arbitrary files, impacting confidentiality integrity availability (per CVSS). D | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-20353 | We need answer as JSON only. Need synthesize. Need be careful. Let's analyze input. CVE-2026-20353. Description generic internal review hardening releases addressing multiple internally discovered vulnerabilities. Vulnerabilities tracked by CVE related to issues with improper control of a resource through lifetime CWE-664. CVSS 9.8 network low no priv no interaction, total CIA. CPE cisco:cisco_secure_email:*:*:*:*:*:*:*:* (no version?). Tags: Information Disclosure, Cisco, Cisco Secure Email. SSVC exploitation none, automatable yes, impact total. EUVD affected versions list. Need output fields. Need follow precision rules. Product_name: "Cisco Secure Email" perhaps includes Gateway and Email and Web Manager? Description mentions Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. The tags "Cisco Secure Email". CPE product cisco_secure_email. Product name should be 1-3 words. "Cisco Secure Email" okay. But maybe primary affected product specifically Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Product_name could "Cisco Secure Email". Need maybe "Cisco Secure Email" because CPE. Summary: original synthesis, not copy description. Need mention vulnerability type maybe improper resource lifetime control. Impact perhaps information disclosure? CVSS says CIA high total but CWE 664 could be memory/resource issues. Need mention affected versions. KEV? Not provided. So no public exploit? We need infer from SSVC exploitation none, no KEV, no POC. Should state not actively exploited, no public POC identified. EPSS? Not provided. "EPSS risk if notable" — no EPSS data, say EPSS not provided. Need exact phrase? "currently no evidence of active exploitation in CISA KEV; SSVC exploitation none; no POC identified at time of analysis." Summary: "Multiple resource-lifetime handling flaws in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager allow unauthenticated remote attackers to fully compromise affected appliances through networ | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|