IX
Network Security
IOS XE
On CISA KEVExploited in the wild
561
CVEs
27
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 20High 266Medium 158Low 1
Watch
Add IOS XE to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-3400 | 8.8 | Sep 24 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to utilize parts of the web UI for which they are not authorized.The… Affected: 16.2.2; 16.3.1; 16.3.1a; 16.3.2; 16.3.3; 16.3.4; +9 more |
| CVE-2020-3141 | 8.8 | Sep 24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to elevate privileges to… Affected: 16.9.4; 17.2.1; 17.3; 17.4.1 |
| CVE-2019-16009 | 8.8 | Sep 23 | A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an… Affected: before 16.1.1 |
| CVE-2020-3229 | 8.8 | Jun 3 | A vulnerability in Role Based Access Control (RBAC) functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacker to execute… Affected: 16.2.2; 16.3.1; 16.3.1a; 16.3.2; 16.3.3; 16.3.4; +34 more |
| CVE-2020-3224 | 8.8 | Jun 3 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to inject IOS commands to… Affected: 16.11.1; 16.11.1a; 16.11.1b; 16.11.1c; 16.11.1s; 16.12.1y |
| CVE-2020-3219 | 8.8 | Jun 3 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with administrative privileges on the… Affected: 16.1.1; 16.1.2; 16.1.3; 16.2.1; 16.2.2; 16.3.1; +34 more |
| CVE-2020-3217 | 8.8 | Jun 3 | A vulnerability in the Topology Discovery Service of Cisco One Platform Kit (onePK) in Cisco IOS Software, Cisco IOS XE Software, Cisco IOS XR Software, and Cisco NX-OS Software… Affected: 3.7.0e; 3.7.1e; 3.7.2e; 3.7.3e; 3.7.4e; 3.7.5e; +34 more |
| CVE-2019-12650 | 8.8 | Sep 25 | Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands with elevated… Affected: 16.6.5; 17.1.1 |
| CVE-2019-12624 | 8.8 | Aug 21 | A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker to conduct a… Affected: 3.0.xe through 3.11.xe |
| CVE-2019-1904 | 8.8 | Jun 21 | A vulnerability in the web-based UI (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an… Affected: 16.1.3; 16.2.1; 16.3.1; 16.1.3; 16.2.1; 16.3.1; +24 more |
| CVE-2019-1754 | 8.8 | Mar 28 | A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS… Affected: 3.2.0ja; 16.7.1; 16.7.1a; 16.7.1b; 16.8.1; 16.8.1a; +10 more |
| CVE-2019-1753 | 8.8 | Mar 28 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the… Affected: 3.2.0ja; 3.6.10e; 16.6.1; 16.6.2; 16.6.3; 16.7.1; +9 more |
| CVE-2019-1743 | 8.8 | Mar 28 | A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected… Affected: 16.2.1; 16.2.2; 16.3.1; 16.3.1a; 16.3.2; 16.3.3; +25 more |
| CVE-2018-0195 | 8.8 | Mar 28 | A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged… Affected: before 16.2.2 |
| CVE-2018-0152 | 8.8 | Mar 28 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to gain elevated privileges on an affected device Affected: 16.1.1 |
| CVE-2017-12230 | 8.8 | Sep 29 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an affected device Affected: 16.2.1 |
| CVE-2017-12226 | 8.8 | Sep 29 | A vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E (Wireless)… Affected: 3.7.0e; 3.7.1e; 3.7.2e; 3.7.3e; 3.7.4e; 3.7.5e |
| CVE-2017-6741 | 8.8 | Jul 17 | A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.3.0; 2.3.1; +34 more |
| CVE-2017-3858 | 8.8 | Mar 22 | A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges Affected: 16.2; 16.2.1 |
| CVE-2026-20301 | 8.6 | Aug 5 | Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability Affected: 3.8.10ce; 3.8.10de; 3.11.3ae; 3.11.3e; 3.11.4e; 3.11.5e; +34 more |
| CVE-2026-20273 | 8.6 | Aug 5 | Cisco IOS XE Software Security Hardening Release Affected: 16.6.2; 16.6.3; 16.6.4; 16.6.4a; 16.6.4s; 16.6.5; +34 more |
| CVE-2026-20271 | 8.6 | Aug 5 | Cisco IOS XE Software Security Hardening Release Affected: 16.6.2; 16.6.3; 16.6.4; 16.6.4a; 16.6.4s; 16.6.5; +34 more |
| CVE-2026-20270 | 8.6 | Aug 5 | Cisco IOS XE Software Security Hardening Release Affected: 16.6.2; 16.6.3; 16.6.4; 16.6.4a; 16.6.4s; 16.6.5; +34 more |
| CVE-2026-20269 | 8.6 | Aug 5 | Cisco IOS XE Software Security Hardening Release Affected: 16.6.2; 16.6.3; 16.6.4; 16.6.4a; 16.6.4s; 16.6.5; +34 more |
| CVE-2026-20268 | 8.6 | Aug 5 | Cisco IOS XE Software Security Hardening Release Affected: 16.6.2; 16.6.3; 16.6.4; 16.6.4a; 16.6.4s; 16.6.5; +34 more |
| CVE-2026-20263 | 8.6 | Aug 5 | Cisco IOS XE Software Blocks Extensible Exchange Protocol Denial of Service Vulnerability Affected: 16.6.2; 16.6.3; 16.6.4; 16.6.4a; 16.6.4s; 16.6.5; +34 more |
| CVE-2026-20012 | 8.6 | Mar 25 | A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA)… Affected: 3.5.0e; 3.5.1e; 3.5.2e; 3.5.3e; 3.6.0e; 3.6.1e; +34 more |
| CVE-2026-20084 | 8.6 | Mar 25 | A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packets to be forwarded between VLANs,… Affected: 16.6.1; 16.6.2; 16.6.3; 16.6.4; 16.6.4a; 16.6.5; +34 more |
| CVE-2025-20315 | 8.6 | Sep 24 | A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to… Affected: 3.7.0bs; 3.7.0s; 3.7.1as; 3.7.1s; 3.7.2s; 3.7.2ts; +34 more |
| CVE-2025-20162 | 8.6 | May 7 | A vulnerability in the DHCP snooping security feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a full interface queue wedge, which could… Affected: 16.11.1; 16.11.1a; 16.11.1s; 16.11.2; 16.12.1; 16.12.1a; +34 more |
| CVE-2025-20154 | 8.6 | May 7 | A vulnerability in the Two-Way Active Measurement Protocol (TWAMP) server feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker… Affected: 16.6.1 through 17.2.3 |
| CVE-2024-20480 | 8.6 | Sep 25 | A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access (SD-Access) fabric edge nodes could allow an unauthenticated, remote attacker to… Affected: 16.1.1; 16.1.2; 16.1.3; 16.2.1; 16.2.2; 16.3.1; +34 more |
| CVE-2024-20467 | 8.6 | Sep 25 | A vulnerability in the implementation of the IPv4 fragmentation reassembly code in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of… Affected: 17.11.99sw; 17.12.1; 17.12.1a |
| CVE-2024-20464 | 8.6 | Sep 25 | A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS)… Affected: 17.13.1; 17.13.1a |
| CVE-2024-20455 | 8.6 | Sep 25 | A vulnerability in the process that classifies traffic that is going to the Unified Threat Defense (UTD) component of Cisco IOS XE Software in controller mode could allow an… Affected: 17.1.1; 17.1.1a; 17.1.1s; 17.1.1t; 17.1.3; 17.2.1; +34 more |
| CVE-2024-20271 | 8.6 | Mar 27 | A vulnerability in the IP packet processing of Cisco Access Point (AP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an… Affected: before 17.3.8; 17.4 before 17.6.6; 17.7 before 17.9.5; 17.10 before 17.12.2 |
| CVE-2024-20259 | 8.6 | Mar 27 | A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting… Affected: 17.1.1; 17.1.1a; 17.1.1s; 17.1.1t; 17.1.3; 17.2.1; +34 more |
| CVE-2023-20033 | 8.6 | Sep 27 | A vulnerability in Cisco IOS XE Software for Cisco Catalyst 3650 and Catalyst 3850 Series Switches could allow an unauthenticated, remote attacker to cause an affected device to… Affected: 16.3.1; 16.3.1a; 16.3.2; 16.3.3; 16.3.4; 16.3.5; +34 more |
| CVE-2023-20072 | 8.6 | Mar 23 | A vulnerability in the fragmentation handling code of tunnel protocol packets in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected system… Affected: 17.9.1; 17.9.1a; 17.9.1w |
| CVE-2023-20027 | 8.6 | Mar 23 | A vulnerability in the implementation of the IPv4 Virtual Fragmentation Reassembly (VFR) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause… Affected: 3.9.0as; 3.9.1s; 3.9.2s; 3.10.0s; 3.10.1s; 3.10.2as; +34 more |
| CVE-2022-20837 | 8.6 | Oct 10 | Cisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service Vulnerability Affected: All versions, or not specified |
| CVE-2022-20870 | 8.6 | Oct 10 | Cisco IOS XE Software for Catalyst Switches MPLS Denial of Service Vulnerability Affected: All versions, or not specified |
| CVE-2022-20697 | 8.6 | Apr 15 | A vulnerability in the web services interface of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS)… Affected: 3.11.3ae; 3.11.3e; 3.11.4e |
| CVE-2022-20683 | 8.6 | Apr 15 | A vulnerability in the Application Visibility and Control (AVC-FNF) feature of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an… Affected: 3.15.1xbs; 3.15.2xbs; 16.7.2; 16.7.3; 16.7.4; 16.8.1; +34 more |
| CVE-2022-20682 | 8.6 | Apr 15 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family… Affected: 3.15.1xbs; 3.15.2xbs; 16.11.1; 16.11.1a; 16.11.1b; 16.11.1c; +34 more |
| CVE-2021-34697 | 8.6 | Sep 23 | A vulnerability in the Protection Against Distributed Denial of Service Attacks feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct denial… Affected: 17.3.1 before 17.3.3 |
| CVE-2021-1624 | 8.6 | Sep 23 | A vulnerability in the Rate Limiting Network Address Translation (NAT) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause high CPU… Affected: through 17.3.3 |
| CVE-2021-1622 | 8.6 | Sep 23 | A vulnerability in the Common Open Policy Service (COPS) of Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacker to… Affected: before 16.12.1z1; 17.3.1x |
| CVE-2021-1611 | 8.6 | Sep 23 | A vulnerability in Ethernet over GRE (EoGRE) packet processing of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9800 Family Wireless Controller, Embedded… Affected: before 17.3.1 |
| CVE-2021-1565 | 8.6 | Sep 23 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9000 Family Wireless… Affected: 3.15.1xbs; 3.15.2xbs; 17.3.1; 17.3.2; 17.4.1; 17.5.1 |
The 500 most important CVEs for this product (exploited first, then by severity)