Cisco vulnerabilities under active exploitation

12 CVEs on this page carry evidence of exploitation.

Which Cisco vulnerabilities are being exploited?

10 of them are in the CISA KEV catalog.

2 were added to KEV in the last 90 days.

• CVE-2026-20349 In KEV since 2026-08-11 · No fix identified here
• CVE-2008-4128 In KEV since 2026-07-13 · EPSS 33% · No fix identified here
• CVE-2026-20182 In KEV since 2026-05-14 · No fix identified here
• CVE-2026-33634 In KEV since 2026-03-26 · No fix identified here
• CVE-2026-20127 In KEV since 2026-02-25 · EPSS 88% · Fix identified
• CVE-2022-20775 In KEV since 2026-02-25 · EPSS 12% · Fix identified
• CVE-2024-36401 In KEV since 2024-07-15 · EPSS 99.8% · No fix identified here
• CVE-2023-32315 In KEV since 2023-08-24 · EPSS 100.0% · No fix identified here
• CVE-2021-26855 In KEV since 2021-11-03 · EPSS 100.0% · Used in ransomware · No fix identified here
• CVE-2018-0171 In KEV since 2021-11-03 · EPSS 99% · No fix identified here
• CVE-2026-22200 EPSS 73% · No fix identified here
• CVE-2026-49975 EPSS 28% · Fix identified

Which of them have a fix?

We can name a fix for 3 of them.

For the rest we hold no patch identifier, which is not the same as no patch existing.

What PlainSec published about Cisco

• Public Exploits Now Feed a Custom Cobalt Strike Loader (2026-06-27)
• Session Spikes Warn Before Network CVE Disclosures (2026-04-20)
• OSPF Denial-of-Service Vulnerabilities in Cisco Secure Firewalls (2026-03-27)
• Cisco Patches IOS Flaws Enabling Privilege Escalation and Persistent DoS (2026-03-26)
• CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA (2026-03-14)
• Cisco SD‑WAN Zero-Day CVE-2026-20127 Exploited by Nation-State (2026-03-10)

Which Cisco products this page tracks

• Cisco
• Cisco ASA
• Cisco Catalyst SD-WAN
• Cisco Catalyst SD-WAN Controller
• Cisco Duo
• Cisco IOS
• Cisco IOS XE
• Cisco IOS XR
• Cisco ISE
• Cisco Identity Services Engine
• Cisco Meraki
• Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
• Cisco Umbrella
• Cisco Webex
• Duo Security
• Meraki

KEV and EPSS are re-checked daily. Page last updated 2026-08-16.