IX
Network Security
IOS XE
On CISA KEVExploited in the wild
561
CVEs
27
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 20High 266Medium 158Low 1
Watch
Add IOS XE to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-20198 In wildKEV | 10.0 | Oct 16 | Cisco IOS XE Web UI Privilege Escalation Vulnerability Affected: 16.12 before 16.12.10a; 17.3 before 17.3.8a; 17.6 before 17.6.6a; 17.9 before 17.9.4a |
| CVE-2018-0151 In wildKEV | 9.8 | Mar 28 | Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability Affected: 16.5.1 |
| CVE-2017-3881 In wildKEV | 9.8 | Mar 17 | Cisco IOS and IOS XE Remote Code Execution Vulnerability Affected: 3.2sg through 3.9e |
| CVE-2025-20188 | 10.0 | May 7 | A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless… Affected: 17.11.1; 17.11.99sw; 17.12.1; 17.12.2; 17.12.3; 17.13.1; +1 more |
| CVE-2019-12643 | 10.0 | Aug 28 | A vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication on the managed… Affected: 15.5(3)s3.16; 16.6.5 |
| CVE-2026-20272 | 9.8 | Aug 5 | Cisco IOS XE Software Security Hardening Release Affected: 16.6.2; 16.6.3; 16.6.4; 16.6.4a; 16.6.4s; 16.6.5; +34 more |
| CVE-2021-34770 | 9.8 | Sep 23 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9000 Family Wireless Controllers… Affected: 3.15.1xbs; 3.15.2xbs; 16.6.4s; 16.10.1; 16.10.1e; 16.10.1s; +22 more |
| CVE-2021-1451 | 9.8 | Mar 24 | A vulnerability in the Easy Virtual Switching System (VSS) feature of Cisco IOS XE Software for Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could… Affected: 3.6.0be; 3.6.0e; 3.6.1e; 3.6.2e; 3.6.3e; 3.6.4e; +34 more |
| CVE-2020-3227 | 9.8 | Jun 3 | A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, remote attacker to… Affected: 3.11.6e; 16.3.1; 16.3.1a; 16.3.2; 16.3.3; 16.3.4; +34 more |
| CVE-2018-0315 | 9.8 | Jun 7 | A vulnerability in the authentication, authorization, and accounting (AAA) security services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute… Affected: 16.7.1; 16.8.1 |
| CVE-2018-0150 | 9.8 | Mar 28 | A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote attacker to log in to a device running an affected release of Cisco IOS XE Software with the… Affected: 16.5.1 |
| CVE-2017-12236 | 9.8 | Sep 29 | A vulnerability in the implementation of the Locator/ID Separation Protocol (LISP) in Cisco IOS XE 3.2 through 16.5 could allow an unauthenticated, remote attacker using an x… Affected: 3.2.0ja; 3.9.1e; 16.5.1c |
| CVE-2017-12229 | 9.8 | Sep 29 | A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 could allow an unauthenticated, remote attacker to bypass authentication… Affected: 3.1.3as; 3.2.0ja; 3.2.1xo; 3.4.7asg; 3.6.5be; 3.8.0ex; +11 more |
| CVE-2016-6441 | 9.8 | Nov 3 | A vulnerability in the Transaction Language 1 (TL1) code of Cisco ASR 900 Series routers could allow an unauthenticated, remote attacker to cause a reload of, or remotely execute… Affected: 3.17.0s; 3.17.1s; 3.17.2s; 3.17s; 3.18.0s; 3.18.1s; +1 more |
| CVE-2024-20510 | 9.3 | Sep 25 | A vulnerability in the Central Web Authentication (CWA) feature of Cisco IOS XE Software for Wireless Controllers could allow an unauthenticated, adjacent attacker to bypass the… Affected: 16.3.1; 16.3.1a; 16.3.2; 16.3.3; 16.3.4; 16.3.5; +34 more |
| CVE-2025-20221 | 9.1 | May 7 | A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and Layer 4 traffic filters Affected: 16.12.13; 17.1.1; 17.1.1s; 17.1.1t; 17.1.3; 17.2.1; +34 more |
| CVE-2023-20186 | 9.1 | Sep 27 | A vulnerability in the Authentication, Authorization, and Accounting (AAA) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to… Affected: 3.2.0se; 3.2.1se; 3.2.2se; 3.2.3se; 3.3.0se; 3.3.0sg; +34 more |
| CVE-2021-1619 | 9.1 | Sep 23 | A vulnerability in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass NETCONF or… Affected: 16.3.1; 16.3.1a; 16.3.2; 16.3.3; 16.3.4; 16.3.5; +34 more |
| CVE-2026-20267 | 9.0 | Aug 5 | Cisco IOS XE Software Security Hardening Release Affected: 16.6.2; 16.6.3; 16.6.4; 16.6.4a; 16.6.4s; 16.6.5; +34 more |
| CVE-2025-20363 | 9.0 | Sep 25 | A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software,… Affected: 3.2.0sg through 17.17.1 |
Showing 20
The 500 most important CVEs for this product (exploited first, then by severity)