{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:10:46.198Z",
  "tag": {
    "id": "cisco",
    "label": "Cisco",
    "isStack": false,
    "url": "https://pwn.watch/t/cisco",
    "feed": "https://pwn.watch/t/cisco/feed.xml"
  },
  "counts": {
    "incidents": 31,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 31
  },
  "incidents": [
    {
      "slug": "cisco-secure-email-gateway-cve-2026-76519",
      "title": "Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability",
      "url": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76519",
      "json": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76519.json",
      "status": "live",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Secure Email Gateway",
      "tags": [
        "cisco",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-76519"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-10-14",
      "closedAt": null,
      "updatedAt": "2026-10-14",
      "summary": "Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Added to CISA KEV on 2026-10-14.",
      "xPost": null
    },
    {
      "slug": "cisco-catalyst-sd-wan-manager-cve-2026-76504",
      "title": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504",
      "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN Manager",
      "tags": [
        "cisco",
        "sd-wan",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-76504"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-30",
      "closedAt": "2026-09-30",
      "updatedAt": "2026-09-30",
      "summary": "Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. Added to CISA KEV on 2026-09-30.",
      "xPost": null
    },
    {
      "slug": "cisco-identity-services-engine-cve-2026-76460",
      "title": "Cisco Identity Services Engine: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability",
      "url": "https://pwn.watch/i/cisco-identity-services-engine-cve-2026-76460",
      "json": "https://pwn.watch/i/cisco-identity-services-engine-cve-2026-76460.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Identity Services Engine",
      "tags": [
        "cisco",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-76460"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-16",
      "closedAt": "2026-09-16",
      "updatedAt": "2026-09-16",
      "summary": "Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. Added to CISA KEV on 2026-09-16.",
      "xPost": null
    },
    {
      "slug": "cisco-secure-email-gateway-cve-2026-76461",
      "title": "Cisco Secure Email Gateway: Cisco Secure Email Gateway SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461",
      "json": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Secure Email Gateway",
      "tags": [
        "cisco",
        "cisa-kev",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2026-76461"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-14",
      "closedAt": "2026-09-14",
      "updatedAt": "2026-09-14",
      "summary": "Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Added to CISA KEV on 2026-09-14.",
      "xPost": null
    },
    {
      "slug": "cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew",
      "title": "Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using",
      "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew",
      "json": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management",
      "tags": [
        "cisco",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2026-20079"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-09",
      "closedAt": "2026-09-09",
      "updatedAt": "2026-09-09",
      "summary": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. Added to CISA KEV on 2026-09-09.",
      "xPost": null
    },
    {
      "slug": "cisco-secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threat",
      "title": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) : Cisco Secure Firewall Adaptive Security Appliance (ASA) and S",
      "url": "https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threat",
      "json": "https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threat.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) ",
      "tags": [
        "cisco",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-20349"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-11",
      "closedAt": "2026-08-11",
      "updatedAt": "2026-08-11",
      "summary": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. Added to CISA KEV on 2026-08-11.",
      "xPost": null
    },
    {
      "slug": "cisco-secure-firewall-management-center-fmc-cve-2026-20316",
      "title": "Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability",
      "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20316",
      "json": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20316.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Secure Firewall Management Center (FMC)",
      "tags": [
        "cisco",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-20316"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-07-29",
      "closedAt": "2026-07-29",
      "updatedAt": "2026-07-29",
      "summary": "Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. Added to CISA KEV on 2026-07-29.",
      "xPost": null
    },
    {
      "slug": "cisco-unified-communications-manager-cve-2026-20230",
      "title": "Cisco Unified Communications Manager: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability",
      "url": "https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20230",
      "json": "https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20230.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Unified Communications Manager",
      "tags": [
        "cisco",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-20230"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-06-25",
      "closedAt": "2026-06-25",
      "updatedAt": "2026-06-25",
      "summary": "Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root. Added to CISA KEV on 2026-06-25.",
      "xPost": null
    },
    {
      "slug": "cisco-catalyst-sd-wan-manager-cve-2026-20262",
      "title": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20262",
      "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20262.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN Manager",
      "tags": [
        "cisco",
        "sd-wan",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-20262"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-06-15",
      "closedAt": "2026-06-15",
      "updatedAt": "2026-06-15",
      "summary": "Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. Added to CISA KEV on 2026-06-15.",
      "xPost": null
    },
    {
      "slug": "cisco-catalyst-sd-wan-manager-cve-2026-20245",
      "title": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20245",
      "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20245.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN Manager",
      "tags": [
        "cisco",
        "sd-wan",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-20245"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-06-09",
      "closedAt": "2026-06-09",
      "updatedAt": "2026-06-09",
      "summary": "Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. Added to CISA KEV on 2026-06-09.",
      "xPost": null
    },
    {
      "slug": "cisco-catalyst-sd-wan-cve-2026-20182",
      "title": "Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182",
      "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN",
      "tags": [
        "cisco",
        "sd-wan",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2026-20182"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-05-14",
      "closedAt": "2026-05-14",
      "updatedAt": "2026-05-14",
      "summary": "Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. Added to CISA KEV on 2026-05-14.",
      "xPost": null
    },
    {
      "slug": "cisco-catalyst-sd-wan-manager-cve-2026-20133",
      "title": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20133",
      "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20133.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN Manager",
      "tags": [
        "cisco",
        "sd-wan",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-20133",
        "CVE-2026-20128"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-04-20",
      "closedAt": "2026-04-20",
      "updatedAt": "2026-04-20",
      "summary": "Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems. CISA added CVE-2026-20133, CVE-2026-20128 to the Known Exploited Vulnerabilities catalog on 2026-04-20 based on evidence of active exploitation.",
      "xPost": null
    },
    {
      "slug": "cisco-catalyst-sd-wan-manger-cve-2026-20122",
      "title": "Cisco Catalyst SD-WAN Manger: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manger-cve-2026-20122",
      "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-manger-cve-2026-20122.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN Manger",
      "tags": [
        "cisco",
        "sd-wan",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-20122"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-04-20",
      "closedAt": "2026-04-20",
      "updatedAt": "2026-04-20",
      "summary": "Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges. Added to CISA KEV on 2026-04-20.",
      "xPost": null
    },
    {
      "slug": "cisco-secure-firewall-management-center-fmc-cve-2026-20131",
      "title": "Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management",
      "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20131",
      "json": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20131.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Secure Firewall Management Center (FMC)",
      "tags": [
        "cisco",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-20131"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-03-19",
      "closedAt": "2026-03-19",
      "updatedAt": "2026-03-19",
      "summary": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. Added to CISA KEV on 2026-03-19.",
      "xPost": null
    },
    {
      "slug": "cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127",
      "title": "Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127",
      "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN Controller and Manager",
      "tags": [
        "cisco",
        "sd-wan",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2026-20127"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-02-25",
      "closedAt": "2026-02-25",
      "updatedAt": "2026-02-25",
      "summary": "Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration f",
      "xPost": null
    },
    {
      "slug": "cisco-sdwan-february-2026-emergency-directive",
      "title": "Cisco Catalyst SD-WAN zero-day campaign (CISA emergency directive)",
      "url": "https://pwn.watch/i/cisco-sdwan-february-2026-emergency-directive",
      "json": "https://pwn.watch/i/cisco-sdwan-february-2026-emergency-directive.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN Manager / controllers",
      "tags": [
        "cisco",
        "sd-wan",
        "zero-day"
      ],
      "cveIds": [],
      "affectedVersions": [
        "See Cisco Security Advisories and CISA emergency directive"
      ],
      "fixedVersions": [
        "Cisco fixed releases per advisory"
      ],
      "startedAt": "2026-02-01",
      "closedAt": "2026-02-28",
      "updatedAt": "2026-02-28",
      "summary": "In February 2026 CISA issued an emergency directive after exploitation of critical authentication-bypass and related flaws in Cisco Catalyst SD-WAN Manager/controllers. Cisco Talos said related activity dated back years; unauthenticated attackers could gain administrative privileges on exposed controllers.",
      "xPost": null
    },
    {
      "slug": "cisco-unified-communications-manager-cve-2026-20045",
      "title": "Cisco Unified Communications Manager: Cisco Unified Communications Products Code Injection Vulnerability",
      "url": "https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20045",
      "json": "https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20045.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Unified Communications Manager",
      "tags": [
        "cisco",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-20045"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-01-21",
      "closedAt": "2026-01-21",
      "updatedAt": "2026-01-21",
      "summary": "Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. Added to CISA KEV on 2026-01-21.",
      "xPost": null
    },
    {
      "slug": "cisco-multiple-products-cve-2025-20393",
      "title": "Cisco Multiple Products: Multiple Products Improper Input Validation Vulnerability",
      "url": "https://pwn.watch/i/cisco-multiple-products-cve-2025-20393",
      "json": "https://pwn.watch/i/cisco-multiple-products-cve-2025-20393.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Cisco Multiple Products",
      "tags": [
        "cisco",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-20393"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-12-17",
      "closedAt": "2025-12-17",
      "updatedAt": "2025-12-17",
      "summary": "Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. Added to CISA KEV on 2025-12-17.",
      "xPost": null
    },
    {
      "slug": "cisco-ios-and-ios-xe-cve-2025-20352",
      "title": "Cisco IOS and IOS XE: IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability",
      "url": "https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2025-20352",
      "json": "https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2025-20352.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco IOS and IOS XE",
      "tags": [
        "cisco",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2025-20352"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-09-29",
      "closedAt": "2025-09-29",
      "updatedAt": "2025-09-29",
      "summary": "Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system. Added to CISA KEV on 2025-09-29.",
      "xPost": null
    },
    {
      "slug": "cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333",
      "title": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense: 2 exploited vulnerabilities (CVE-2025-20333, CVE-2025-20362)",
      "url": "https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333",
      "json": "https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense",
      "tags": [
        "cisco",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2025-20333",
        "CVE-2025-20362"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-09-25",
      "closedAt": "2025-09-25",
      "updatedAt": "2025-09-25",
      "summary": "CVE-2025-20333: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362. CVE-2025-20362: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333. Added to CISA KEV on 2025-09-25.",
      "xPost": null
    },
    {
      "slug": "cisco-identity-services-engine-cve-2025-20281",
      "title": "Cisco Identity Services Engine: 2 exploited vulnerabilities (CVE-2025-20281, CVE-2025-20337)",
      "url": "https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281",
      "json": "https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Cisco Identity Services Engine",
      "tags": [
        "cisco",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2025-20281",
        "CVE-2025-20337"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-07-28",
      "closedAt": "2025-07-28",
      "updatedAt": "2025-07-28",
      "summary": "CVE-2025-20281: Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. CVE-2025-20337: Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. Added to CISA KEV on 2025-07-28.",
      "xPost": null
    },
    {
      "slug": "cisco-smart-licensing-utility-cve-2024-20439",
      "title": "Cisco Smart Licensing Utility: Smart Licensing Utility Static Credential Vulnerability",
      "url": "https://pwn.watch/i/cisco-smart-licensing-utility-cve-2024-20439",
      "json": "https://pwn.watch/i/cisco-smart-licensing-utility-cve-2024-20439.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Cisco Smart Licensing Utility",
      "tags": [
        "cisco",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-20439"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-03-31",
      "closedAt": "2025-03-31",
      "updatedAt": "2025-03-31",
      "summary": "Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials. Added to CISA KEV on 2025-03-31.",
      "xPost": null
    },
    {
      "slug": "cisco-small-business-rv-series-routers-cve-2023-20118",
      "title": "Cisco Small Business RV Series Routers: Small Business RV Series Routers Command Injection Vulnerability",
      "url": "https://pwn.watch/i/cisco-small-business-rv-series-routers-cve-2023-20118",
      "json": "https://pwn.watch/i/cisco-small-business-rv-series-routers-cve-2023-20118.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Cisco Small Business RV Series Routers",
      "tags": [
        "cisco",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2023-20118"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-03-03",
      "closedAt": "2025-03-03",
      "updatedAt": "2025-03-03",
      "summary": "Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data. Added to CISA KEV on 2025-03-03.",
      "xPost": null
    },
    {
      "slug": "cisco-adaptive-security-appliance-asa-cve-2014-2120",
      "title": "Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS)",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-cve-2014-2120",
      "json": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-cve-2014-2120.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Cisco Adaptive Security Appliance (ASA)",
      "tags": [
        "cisco",
        "cisco-asa",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2014-2120"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-11-12",
      "closedAt": "2024-11-12",
      "updatedAt": "2024-11-12",
      "summary": "Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. Added to the CISA KEV catalog on 2024-11-12. CVE-2014-2120 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481",
      "title": "Cisco ASA and FTD Denial-of-Service",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481",
      "json": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
      "tags": [
        "cisco",
        "cisco-asa",
        "cisco-ftd",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-20481"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-10-23",
      "closedAt": "2024-10-24",
      "updatedAt": "2024-10-24",
      "summary": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service. Added to the CISA KEV catalog on 2024-10-24.",
      "xPost": null
    },
    {
      "slug": "cisco-nx-os-cve-2024-20399",
      "title": "Cisco NX-OS Command Injection",
      "url": "https://pwn.watch/i/cisco-nx-os-cve-2024-20399",
      "json": "https://pwn.watch/i/cisco-nx-os-cve-2024-20399.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Cisco NX-OS",
      "tags": [
        "cisco",
        "nx-os",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-20399"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-07-01",
      "closedAt": "2024-07-02",
      "updatedAt": "2024-07-02",
      "summary": "Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device. Added to the CISA KEV catalog on 2024-07-02.",
      "xPost": null
    },
    {
      "slug": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "title": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "json": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
      "tags": [
        "cisco",
        "cisco-asa",
        "cisco-ftd",
        "zero-day",
        "espionage",
        "firewall",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-20353",
        "CVE-2024-20359"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-04-24",
      "closedAt": "2024-04-24",
      "updatedAt": "2024-04-24",
      "summary": "Cisco Talos disclosed ArcaneDoor, a state-sponsored campaign against perimeter devices that exploited two Cisco Adaptive Security Appliance and Firepower Threat Defense zero-days: a denial of service (CVE-2024-20353) and a persistent local code execution bug (CVE-2024-20359), used to plant the Line Dancer and Line Runner implants. Added to the CISA KEV catalog on 2024-04-24.",
      "xPost": null
    },
    {
      "slug": "cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259",
      "title": "Cisco ASA and FTD Information Disclosure",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259",
      "json": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
      "tags": [
        "cisco",
        "cisco-asa",
        "cisco-ftd",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2020-3259"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-02-15",
      "closedAt": "2024-02-15",
      "updatedAt": "2024-02-15",
      "summary": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. Added to the CISA KEV catalog on 2024-02-15. CISA lists known use in ransomware campaigns. CVE-2020-3259 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "cisco-ios-and-ios-xe-cve-2023-20109",
      "title": "Cisco IOS and IOS XE: Group Encrypted Transport VPN Out-of-Bounds Write (CVE-2023-20109)",
      "url": "https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2023-20109",
      "json": "https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2023-20109.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Cisco IOS and IOS XE",
      "tags": [
        "cisco",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-20109"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-10-10",
      "closedAt": "2023-10-10",
      "updatedAt": "2023-10-10",
      "summary": "Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash. Added to CISA KEV on 2023-10-10.",
      "xPost": null
    },
    {
      "slug": "cisco-ios-xe-web-ui-implants-cve-2023-20198",
      "title": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices",
      "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198",
      "json": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Cisco IOS XE Software (web UI)",
      "tags": [
        "cisco",
        "ios-xe",
        "zero-day",
        "auth-bypass",
        "rce",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-20198",
        "CVE-2023-20273"
      ],
      "affectedVersions": [
        "IOS XE with the HTTP/HTTPS server (web UI) enabled; see vendor advisory"
      ],
      "fixedVersions": [
        "17.9.4a",
        "17.6.6a",
        "17.3.8a",
        "16.12.10a (Catalyst 3650/3850 only)"
      ],
      "startedAt": "2023-09-18",
      "closedAt": "2023-10-23",
      "updatedAt": "2023-10-23",
      "summary": "Attackers chained two zero-days in the Cisco IOS XE web UI. CVE-2023-20198 let them create a privilege-15 account, and CVE-2023-20273 let them write a root-level implant. Internet scans soon found implants on tens of thousands of switches and routers.",
      "xPost": null
    },
    {
      "slug": "cisco-adaptive-security-appliance-and-threat-cve-2023-20269",
      "title": "Cisco Adaptive Security Appliance and Firepower Threat Defense: Unauthorized Access (CVE-2023-20269)",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-and-threat-cve-2023-20269",
      "json": "https://pwn.watch/i/cisco-adaptive-security-appliance-and-threat-cve-2023-20269.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Cisco Adaptive Security Appliance and Firepower Threat Defense",
      "tags": [
        "cisco",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-20269"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-09-13",
      "closedAt": "2023-09-13",
      "updatedAt": "2023-09-13",
      "summary": "Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user. Added to CISA KEV on 2023-09-13. CISA lists known use in ransomware campaigns.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "cisco-secure-email-gateway-cve-2026-76519",
      "incidentTitle": "Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability",
      "severity": "high",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-14",
      "title": "CISA added CVE-2026-76519 to the KEV catalog (due 2026-10-17).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76519"
    },
    {
      "incident": "cisco-catalyst-sd-wan-manager-cve-2026-76504",
      "incidentTitle": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-30",
      "title": "CISA added CVE-2026-76504 to the KEV catalog (due 2026-10-03).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504"
    },
    {
      "incident": "cisco-identity-services-engine-cve-2026-76460",
      "incidentTitle": "Cisco Identity Services Engine: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-16",
      "title": "CISA added CVE-2026-76460 to the KEV catalog (due 2026-09-19).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-identity-services-engine-cve-2026-76460"
    },
    {
      "incident": "cisco-secure-email-gateway-cve-2026-76461",
      "incidentTitle": "Cisco Secure Email Gateway: Cisco Secure Email Gateway SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-14",
      "title": "CISA added CVE-2026-76461 to the KEV catalog (due 2026-09-17).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461"
    },
    {
      "incident": "cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew",
      "incidentTitle": "Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-09",
      "title": "CISA added CVE-2026-20079 to the KEV catalog (due 2026-09-12).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew"
    },
    {
      "incident": "cisco-secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threat",
      "incidentTitle": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) : Cisco Secure Firewall Adaptive Security Appliance (ASA) and S",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-11",
      "title": "CISA added CVE-2026-20349 to the KEV catalog (due 2026-08-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threat"
    },
    {
      "incident": "cisco-secure-firewall-management-center-fmc-cve-2026-20316",
      "incidentTitle": "Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-07-29",
      "title": "CISA added CVE-2026-20316 to the KEV catalog (due 2026-08-01).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20316"
    },
    {
      "incident": "cisco-unified-communications-manager-cve-2026-20230",
      "incidentTitle": "Cisco Unified Communications Manager: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-06-25",
      "title": "CISA added CVE-2026-20230 to the KEV catalog (due 2026-06-28).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20230"
    },
    {
      "incident": "cisco-catalyst-sd-wan-manager-cve-2026-20262",
      "incidentTitle": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-06-15",
      "title": "CISA added CVE-2026-20262 to the KEV catalog (due 2026-06-29).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20262"
    },
    {
      "incident": "cisco-catalyst-sd-wan-manager-cve-2026-20245",
      "incidentTitle": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-06-09",
      "title": "CISA added CVE-2026-20245 to the KEV catalog (due 2026-06-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20245"
    },
    {
      "incident": "cisco-catalyst-sd-wan-cve-2026-20182",
      "incidentTitle": "Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-05-14",
      "title": "CISA added CVE-2026-20182 to the KEV catalog (due 2026-05-17).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182"
    },
    {
      "incident": "cisco-catalyst-sd-wan-manager-cve-2026-20133",
      "incidentTitle": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-04-20",
      "title": "CISA added CVE-2026-20133, CVE-2026-20128 to the KEV catalog (due 2026-04-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20133"
    },
    {
      "incident": "cisco-catalyst-sd-wan-manger-cve-2026-20122",
      "incidentTitle": "Cisco Catalyst SD-WAN Manger: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-04-20",
      "title": "CISA added CVE-2026-20122 to the KEV catalog (due 2026-04-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manger-cve-2026-20122"
    },
    {
      "incident": "cisco-secure-firewall-management-center-fmc-cve-2026-20131",
      "incidentTitle": "Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03-19",
      "title": "CISA added CVE-2026-20131 to the KEV catalog (due 2026-03-22).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20131"
    },
    {
      "incident": "cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127",
      "incidentTitle": "Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-02-25",
      "title": "CISA added CVE-2026-20127 to the KEV catalog (due 2026-02-27).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127"
    },
    {
      "incident": "cisco-unified-communications-manager-cve-2026-20045",
      "incidentTitle": "Cisco Unified Communications Manager: Cisco Unified Communications Products Code Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-01-21",
      "title": "CISA added CVE-2026-20045 to the KEV catalog (due 2026-02-11).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20045"
    },
    {
      "incident": "cisco-multiple-products-cve-2025-20393",
      "incidentTitle": "Cisco Multiple Products: Multiple Products Improper Input Validation Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-12-17",
      "title": "CISA added CVE-2025-20393 to the KEV catalog (due 2025-12-24).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-multiple-products-cve-2025-20393"
    },
    {
      "incident": "cisco-ios-and-ios-xe-cve-2025-20352",
      "incidentTitle": "Cisco IOS and IOS XE: IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-29",
      "title": "CISA added CVE-2025-20352 to the KEV catalog (due 2025-10-20).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2025-20352"
    },
    {
      "incident": "cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333",
      "incidentTitle": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense: 2 exploited vulnerabilities (CVE-2025-20333, CVE-2025-20362)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-25",
      "title": "CISA added CVE-2025-20333 to the KEV catalog (due 2025-09-26).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333"
    },
    {
      "incident": "cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333",
      "incidentTitle": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense: 2 exploited vulnerabilities (CVE-2025-20333, CVE-2025-20362)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-25",
      "title": "CISA added CVE-2025-20362 to the KEV catalog (due 2025-09-26).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333"
    },
    {
      "incident": "cisco-identity-services-engine-cve-2025-20281",
      "incidentTitle": "Cisco Identity Services Engine: 2 exploited vulnerabilities (CVE-2025-20281, CVE-2025-20337)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-28",
      "title": "CISA added CVE-2025-20281 to the KEV catalog (due 2025-08-18).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281"
    },
    {
      "incident": "cisco-identity-services-engine-cve-2025-20281",
      "incidentTitle": "Cisco Identity Services Engine: 2 exploited vulnerabilities (CVE-2025-20281, CVE-2025-20337)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-28",
      "title": "CISA added CVE-2025-20337 to the KEV catalog (due 2025-08-18).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281"
    },
    {
      "incident": "cisco-smart-licensing-utility-cve-2024-20439",
      "incidentTitle": "Cisco Smart Licensing Utility: Smart Licensing Utility Static Credential Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-31",
      "title": "CISA added CVE-2024-20439 to the KEV catalog (due 2025-04-21).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-smart-licensing-utility-cve-2024-20439"
    },
    {
      "incident": "cisco-small-business-rv-series-routers-cve-2023-20118",
      "incidentTitle": "Cisco Small Business RV Series Routers: Small Business RV Series Routers Command Injection Vulnerability",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-03",
      "title": "CISA added CVE-2023-20118 to the KEV catalog (due 2025-03-24).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-small-business-rv-series-routers-cve-2023-20118"
    },
    {
      "incident": "cisco-adaptive-security-appliance-asa-cve-2014-2120",
      "incidentTitle": "Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-12",
      "title": "CISA added CVE-2014-2120 to the KEV catalog (federal deadline 2024-12-03)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-cve-2014-2120"
    },
    {
      "incident": "cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481",
      "incidentTitle": "Cisco ASA and FTD Denial-of-Service",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-24",
      "title": "CISA added CVE-2024-20481 to the KEV catalog (federal deadline 2024-11-14)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481"
    },
    {
      "incident": "cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481",
      "incidentTitle": "Cisco ASA and FTD Denial-of-Service",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-23",
      "title": "CVE-2024-20481 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20481",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481"
    },
    {
      "incident": "cisco-nx-os-cve-2024-20399",
      "incidentTitle": "Cisco NX-OS Command Injection",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-07-02",
      "title": "CISA added CVE-2024-20399 to the KEV catalog (federal deadline 2024-07-23)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-nx-os-cve-2024-20399"
    },
    {
      "incident": "cisco-nx-os-cve-2024-20399",
      "incidentTitle": "Cisco NX-OS Command Injection",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-07-01",
      "title": "CVE-2024-20399 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20399",
      "url": "https://pwn.watch/i/cisco-nx-os-cve-2024-20399"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CVE-2024-20353 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20353",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CVE-2024-20359 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20359",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CISA added CVE-2024-20353 to the KEV catalog (federal deadline 2024-05-01)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CISA added CVE-2024-20359 to the KEV catalog (federal deadline 2024-05-01)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "Cisco Talos discloses the ArcaneDoor campaign; Cisco ships fixes",
      "body": null,
      "sourceUrl": "https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259",
      "incidentTitle": "Cisco ASA and FTD Information Disclosure",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-15",
      "title": "CISA added CVE-2020-3259 to the KEV catalog (federal deadline 2024-03-07)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259"
    },
    {
      "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198",
      "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-23",
      "title": "CISA adds CVE-2023-20273 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198"
    },
    {
      "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198",
      "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-22",
      "title": "First fixed release, 17.9.4a, published",
      "body": null,
      "sourceUrl": "https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-iosxe-webui-privesc-j22SaA4z.html",
      "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198"
    },
    {
      "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198",
      "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-20",
      "title": "Cisco discloses the second bug (CVE-2023-20273) used to write the implant as root",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198"
    },
    {
      "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198",
      "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-16",
      "title": "Cisco advisory and Talos write-up on active exploitation; CISA adds CVE-2023-20198 to KEV",
      "body": null,
      "sourceUrl": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z",
      "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198"
    },
    {
      "incident": "cisco-ios-and-ios-xe-cve-2023-20109",
      "incidentTitle": "Cisco IOS and IOS XE: Group Encrypted Transport VPN Out-of-Bounds Write (CVE-2023-20109)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-10",
      "title": "CISA added CVE-2023-20109 to the KEV catalog (due 2023-10-31).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2023-20109"
    },
    {
      "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198",
      "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-18",
      "title": "Earliest malicious activity found by Cisco Talos",
      "body": null,
      "sourceUrl": "https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/",
      "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198"
    },
    {
      "incident": "cisco-adaptive-security-appliance-and-threat-cve-2023-20269",
      "incidentTitle": "Cisco Adaptive Security Appliance and Firepower Threat Defense: Unauthorized Access (CVE-2023-20269)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-13",
      "title": "CISA added CVE-2023-20269 to the KEV catalog (due 2023-10-04).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-and-threat-cve-2023-20269"
    }
  ]
}