CI
Product
Cisco IOS XE Software
On CISA KEVExploited in the wild
94
CVEs
6
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 7High 55Medium 32Low 0
Watch
Add Cisco IOS XE Software to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-20109 In wildKEV | 6.6 | Sep 27 | Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability Affected: 3.7.0S; 3.7.1S; 3.7.2S; 3.7.3S; 3.7.4S; 3.7.5S; +34 more |
| CVE-2022-20944 | 6.8 | Oct 10 | Cisco IOS XE Software for Catalyst 9200 Series Switches Arbitrary Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2025-20314 | 6.7 | Sep 24 | A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to an affected… Affected: 17.3.1; 17.3.2; 17.3.3; 17.3.1a; 17.3.1w; 17.3.2a; +34 more |
| CVE-2025-20338 | 6.7 | Sep 24 | A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands as root on the… Affected: 3.5.0E; 3.5.1E; 3.5.2E; 3.5.3E; 3.11.1S; 3.11.2S; +34 more |
| CVE-2025-20313 | 6.7 | Sep 24 | Multiple vulnerabilities in Cisco IOS XE Software of could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to… Affected: 17.3.1; 17.3.2; 17.3.3; 17.3.1a; 17.3.1w; 17.3.2a; +34 more |
| CVE-2025-20201 | 6.7 | May 7 | A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating… Affected: 3.7.0S; 3.7.1S; 3.7.2S; 3.7.3S; 3.7.4S; 3.7.5S; +34 more |
| CVE-2022-20855 | 6.7 | Sep 30 | Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points Privilege Escalation Vulnerability Affected: All versions, or not specified |
| CVE-2026-20083 | 6.5 | Mar 25 | A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated, local attacker with low privileges to cause a denial of… Affected: 3.5.0E; 3.5.1E; 3.5.2E; 3.5.3E; 3.11.1S; 3.11.2S; +34 more |
| CVE-2026-20110 | 6.5 | Mar 25 | A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device Affected: 16.6.1; 16.6.2; 16.6.3; 16.6.4; 16.6.5; 16.6.4a; +34 more |
| CVE-2025-20149 | 6.5 | Sep 24 | A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly,… Affected: 3.7.0S; 3.7.1S; 3.7.2S; 3.7.3S; 3.7.4S; 3.7.5S; +34 more |
| CVE-2025-20193 | 6.5 | May 7 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker to perform an injection attack against… Affected: 17.3.1; 17.3.2; 17.3.3; 17.3.1a; 17.3.1w; 17.3.2a; +34 more |
| CVE-2025-20190 | 6.5 | May 7 | A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are… Affected: 17.6.8; 17.9.6; 17.9.6a; 17.12.1z2; 17.12.1z3; 17.15.1; +1 more |
| CVE-2024-20414 | 6.5 | Sep 25 | A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery… Affected: 3.2.0SG; 3.2.1SG; 3.2.2SG; 3.2.3SG; 3.2.4SG; 3.2.5SG; +34 more |
| CVE-2022-20810 | 6.5 | Sep 30 | Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family SNMP Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2026-20311 | 6.3 | Aug 5 | Cisco IOS XE Software Web UI Denial of Service Vulnerability Affected: 17.3.1; 17.3.1a; 17.3.2a; 17.3.1w; 17.3.2; 17.4.1; +34 more |
| CVE-2026-20115 | 6.1 | Mar 25 | A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information Affected: 17.14.1; 17.14.1a; 17.15.1; 17.15.1w; 17.15.1a; 17.15.2; +19 more |
| CVE-2026-20104 | 6.1 | Mar 25 | A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches, Cisco Catalyst ESS9300 Embedded Series Switches, Cisco Catalyst IE9310 and… Affected: 16.12.8; 16.12.6; 16.12.6a; 16.12.7; 17.3.3; 17.3.4; +34 more |
| CVE-2025-20240 | 6.1 | Sep 24 | A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS)… Affected: 16.6.1; 16.6.2; 16.6.3; 16.6.4; 16.6.5; 16.6.4a; +34 more |
| CVE-2025-20155 | 6.0 | May 7 | A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system Affected: 17.9.4; 17.9.5; 17.9.4a; 17.9.5a; 17.9.5b; 17.9.6; +22 more |
| CVE-2025-20225 | 5.8 | Aug 14 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall Adaptive Security Appliance (ASA) Software, and… Affected: 3.3.0SG; 3.3.2SG; 3.3.1SG; 3.4.0SG; 3.4.2SG; 3.4.1SG; +34 more |
| CVE-2026-20114 | 5.4 | Mar 25 | A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access… Affected: 16.11.1; 16.11.1a; 16.11.1b; 16.11.2; 16.11.1s; 16.12.1; +34 more |
| CVE-2025-20194 | 5.4 | May 7 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker to perform an injection attack against… Affected: 17.3.1; 17.3.2; 17.3.3; 17.3.1a; 17.3.1w; 17.3.2a; +34 more |
| CVE-2026-20113 | 5.3 | Mar 25 | A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform… Affected: 16.6.1; 16.6.2; 16.6.3; 16.6.4; 16.6.5; 16.6.4a; +34 more |
| CVE-2025-20316 | 5.3 | Sep 24 | A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthenticated, remote… Affected: 17.7.1; 17.10.1; 17.10.1b; 17.8.1; 17.9.1; 17.9.2; +21 more |
| CVE-2025-20293 | 5.3 | Sep 24 | A vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) could allow an unauthenticated, remote… Affected: 16.10.1; 16.10.1s; 16.10.1e; 16.11.1; 16.11.1a; 16.11.1b; +34 more |
| CVE-2025-20196 | 5.3 | May 7 | A vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the Cisco… Affected: 16.1.1; 16.1.2; 16.1.3; 16.2.1; 16.2.2; 16.3.1; +34 more |
| CVE-2026-20112 | 4.8 | Mar 25 | A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a… Affected: 16.6.1; 16.6.2; 16.6.3; 16.6.4; 16.6.5; 16.6.4a; +34 more |
| CVE-2022-20864 | 4.6 | Oct 10 | Cisco IOS XE ROM Monitor Software for Catalyst Switches Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2026-20308 | 4.3 | Aug 5 | Cisco IOS XE Software Web-Based Management Interface Vulnerability Affected: 17.2.1a; 16.12.1y; 16.12.3s; 16.12.1w; 16.9.1d; 17.3.1; +34 more |
| CVE-2025-20195 | 4.3 | May 7 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a CSRF attack and execute commands on the… Affected: 16.1.1; 16.1.2; 16.1.3; 16.2.1; 16.2.2; 16.3.1; +34 more |
| CVE-2025-20214 | 4.3 | May 7 | A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticated, remote attacker to obtain unauthorized read access… Affected: 17.11.1; 17.11.1a; 17.12.1; 17.12.1w; 17.12.1a; 17.12.1x; +8 more |
| CVE-2024-20434 | 4.3 | Sep 25 | A vulnerability in Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on the control plane of an affected device Affected: 16.6.1; 16.6.2; 16.6.3; 16.6.4; 16.6.5; 16.6.4a; +34 more |
Showing 32