IX
Network Security
IOS XE
On CISA KEVExploited in the wild
561
CVEs
27
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 20High 266Medium 158Low 1
Watch
Add IOS XE to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-0167 In wildKEV | 8.8 | Mar 28 | Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability Affected: 5.2.0.base; through 15.6.3m1; through 15.2\(6\)e0a; through 15.2\(4a\)ea5 |
| CVE-2017-6738 In wildKEV | 8.8 | Jul 17 | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability Affected: 2.2.0 through 3.17.0 |
| CVE-2017-6736 In wildKEV | 8.8 | Jul 17 | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability Affected: 2.2.0 through 3.17 |
| CVE-2017-6737 In wildKEV | 8.8 | Jul 17 | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability Affected: 2.2.0 through 3.17.0 |
| CVE-2017-6742 In wildKEV | 8.8 | Jul 17 | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability Affected: 2.2.0 through 3.17 |
| CVE-2017-6743 In wildKEV | 8.8 | Jul 17 | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability Affected: 2.2.0 through 3.17 |
| CVE-2017-6740 In wildKEV | 8.8 | Jul 17 | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability Affected: 2.2.0 through 3.17 |
| CVE-2017-6739 In wildKEV | 8.8 | Jul 17 | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability Affected: 2.2.0 through 3.17.0 |
| CVE-2018-0172 In wildKEV | 8.6 | Mar 28 | Cisco IOS and IOS XE Software Improper Input Validation Vulnerability Affected: All versions, or not specified |
| CVE-2018-0158 In wildKEV | 8.6 | Mar 28 | Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability Affected: 15.5(3)s1.1; 15.5(3)s1.2; 15.5(3)s1.4; 15.5(3)s1.5; 15.5(3)s1.7; 15.5(3)s1.8; +14 more |
| CVE-2018-0155 In wildKEV | 8.6 | Mar 28 | Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability Affected: 3.6(2)e; 3.6(2)e |
| CVE-2018-0174 In wildKEV | 8.6 | Mar 28 | Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability Affected: 12.2(33)sre7a; through 15.2\(4a\)ea5; through 15.2\(6\)e0a |
| CVE-2018-0173 In wildKEV | 8.6 | Mar 28 | Cisco IOS and IOS XE Software Improper Input Validation Vulnerability Affected: denali-16.3.4; through 15.2\(6\)e0a; through 15.2\(4a\)ea5 |
| CVE-2018-0175 In wildKEV | 8.0 | Mar 28 | Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability Affected: 15.4(3)m4.1; through 15.2\(4a\)ea5; through 15.2\(6\)e0a; through 15.6.3m1 |
| CVE-2025-20352 In wildKEV | 7.7 | Sep 24 | Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability Affected: 3.5.0e; 3.5.0sq; 3.5.1e; 3.5.1sq; 3.5.2e; 3.5.2sq; +34 more |
| CVE-2018-0159 In wildKEV | 7.5 | Mar 28 | Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability Affected: 15.3(3)s |
| CVE-2018-0156 In wildKEV | 7.5 | Mar 28 | Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability Affected: 15.2(2)e4; 15.2(2a)ja |
| CVE-2017-12237 In wildKEV | 7.5 | Sep 28 | Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability Affected: 3.5.0e through 16.5 |
| CVE-2017-6627 In wildKEV | 7.5 | Sep 7 | Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability Affected: 3.14.0s; 3.14.1s; 3.14.2s; 3.14.3s; 3.14.4s; 3.15.0s; +30 more |
| CVE-2016-6415 In wildKEV | 7.5 | Sep 19 | Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability Affected: through 3.18s |
| CVE-2023-20273 In wildKEV | 7.2 | Oct 24 | Cisco IOS XE Web UI Command Injection Vulnerability Affected: 16.1.1; 16.1.2; 16.1.3; 16.2.1; 16.2.2; 16.3.1a; +34 more |
| CVE-2025-20186 | 8.8 | May 7 | A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote attacker with a lobby… Affected: 16.12.4; 16.12.4a; 16.12.5; 16.12.6; 16.12.6a; 16.12.7; +34 more |
| CVE-2024-20437 | 8.8 | Sep 25 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a cross-site request forgery (CSRF)… Affected: 17.3.2; 17.3.2a; 17.3.3; 17.3.4; 17.3.4a; 17.3.4b; +34 more |
| CVE-2023-20235 | 8.8 | Oct 4 | A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an… Affected: before 17.3.1 |
| CVE-2023-20231 | 8.8 | Sep 27 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device Affected: 16.12.4; 16.12.4a; 16.12.5; 16.12.5a; 16.12.5b; 16.12.6; +34 more |
| CVE-2023-20076 | 8.8 | Feb 12 | A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host… Affected: before 17.6.5; 17.9.0 before 17.9.2; 17.10.0 |
| CVE-2020-3425 | 8.8 | Sep 24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to elevate privileges to… Affected: 16.1.1; 16.1.2; 16.1.3; 16.2.1; 16.2.2; 16.3.1; +34 more |
| CVE-2020-3400 | 8.8 | Sep 24 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to utilize parts of the web UI for which they are not authorized.The… Affected: 16.2.2; 16.3.1; 16.3.1a; 16.3.2; 16.3.3; 16.3.4; +9 more |
| CVE-2020-3141 | 8.8 | Sep 24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to elevate privileges to… Affected: 16.9.4; 17.2.1; 17.3; 17.4.1 |
| CVE-2019-16009 | 8.8 | Sep 23 | A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an… Affected: before 16.1.1 |
| CVE-2020-3229 | 8.8 | Jun 3 | A vulnerability in Role Based Access Control (RBAC) functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacker to execute… Affected: 16.2.2; 16.3.1; 16.3.1a; 16.3.2; 16.3.3; 16.3.4; +34 more |
| CVE-2020-3224 | 8.8 | Jun 3 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to inject IOS commands to… Affected: 16.11.1; 16.11.1a; 16.11.1b; 16.11.1c; 16.11.1s; 16.12.1y |
| CVE-2020-3219 | 8.8 | Jun 3 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with administrative privileges on the… Affected: 16.1.1; 16.1.2; 16.1.3; 16.2.1; 16.2.2; 16.3.1; +34 more |
| CVE-2020-3217 | 8.8 | Jun 3 | A vulnerability in the Topology Discovery Service of Cisco One Platform Kit (onePK) in Cisco IOS Software, Cisco IOS XE Software, Cisco IOS XR Software, and Cisco NX-OS Software… Affected: 3.7.0e; 3.7.1e; 3.7.2e; 3.7.3e; 3.7.4e; 3.7.5e; +34 more |
| CVE-2019-12650 | 8.8 | Sep 25 | Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands with elevated… Affected: 16.6.5; 17.1.1 |
| CVE-2019-12624 | 8.8 | Aug 21 | A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker to conduct a… Affected: 3.0.xe through 3.11.xe |
| CVE-2019-1904 | 8.8 | Jun 21 | A vulnerability in the web-based UI (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an… Affected: 16.1.3; 16.2.1; 16.3.1; 16.1.3; 16.2.1; 16.3.1; +24 more |
| CVE-2019-1754 | 8.8 | Mar 28 | A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS… Affected: 3.2.0ja; 16.7.1; 16.7.1a; 16.7.1b; 16.8.1; 16.8.1a; +10 more |
| CVE-2019-1753 | 8.8 | Mar 28 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the… Affected: 3.2.0ja; 3.6.10e; 16.6.1; 16.6.2; 16.6.3; 16.7.1; +9 more |
| CVE-2019-1743 | 8.8 | Mar 28 | A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected… Affected: 16.2.1; 16.2.2; 16.3.1; 16.3.1a; 16.3.2; 16.3.3; +25 more |
| CVE-2018-0195 | 8.8 | Mar 28 | A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged… Affected: before 16.2.2 |
| CVE-2018-0152 | 8.8 | Mar 28 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to gain elevated privileges on an affected device Affected: 16.1.1 |
| CVE-2017-12230 | 8.8 | Sep 29 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an affected device Affected: 16.2.1 |
| CVE-2017-12226 | 8.8 | Sep 29 | A vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E (Wireless)… Affected: 3.7.0e; 3.7.1e; 3.7.2e; 3.7.3e; 3.7.4e; 3.7.5e |
| CVE-2017-6741 | 8.8 | Jul 17 | A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.3.0; 2.3.1; +34 more |
| CVE-2017-3858 | 8.8 | Mar 22 | A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges Affected: 16.2; 16.2.1 |
| CVE-2026-20301 | 8.6 | Aug 5 | Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability Affected: 3.8.10ce; 3.8.10de; 3.11.3ae; 3.11.3e; 3.11.4e; 3.11.5e; +34 more |
| CVE-2026-20273 | 8.6 | Aug 5 | Cisco IOS XE Software Security Hardening Release Affected: 16.6.2; 16.6.3; 16.6.4; 16.6.4a; 16.6.4s; 16.6.5; +34 more |
| CVE-2026-20271 | 8.6 | Aug 5 | Cisco IOS XE Software Security Hardening Release Affected: 16.6.2; 16.6.3; 16.6.4; 16.6.4a; 16.6.4s; 16.6.5; +34 more |
| CVE-2026-20270 | 8.6 | Aug 5 | Cisco IOS XE Software Security Hardening Release Affected: 16.6.2; 16.6.3; 16.6.4; 16.6.4a; 16.6.4s; 16.6.5; +34 more |
The 500 most important CVEs for this product (exploited first, then by severity)