# Cisco security incidents · pwn.watch

> Security incidents tagged Cisco (vendor, product, platform or attack type).

Page: https://pwn.watch/t/cisco · generated 2026-10-22T17:40:31.642Z

## Status (as of 2026-10-22)
- Incidents: 31 (1 live, 0 live and not fully patched, 31 patched)
- Days without a Cisco security incident: 8
- Newest incident started: 2026-10-14

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/cisco.json
- RSS (one item per incident, bumped on each update): https://pwn.watch/t/cisco/feed.xml
- This file: https://pwn.watch/t/cisco/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability](https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76519) ([json](https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76519.json)): high, live, patched, started 2026-10-14, CVE-2026-76519
- [Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504.json)): high, closed, patched, started 2026-09-30, CVE-2026-76504
- [Cisco Identity Services Engine: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability](https://pwn.watch/i/cisco-identity-services-engine-cve-2026-76460) ([json](https://pwn.watch/i/cisco-identity-services-engine-cve-2026-76460.json)): high, closed, patched, started 2026-09-16, CVE-2026-76460
- [Cisco Secure Email Gateway: Cisco Secure Email Gateway SQL Injection Vulnerability](https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461) ([json](https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461.json)): high, closed, patched, started 2026-09-14, CVE-2026-76461
- [Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew) ([json](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew.json)): high, closed, patched, started 2026-09-09, CVE-2026-20079
- [Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) : Cisco Secure Firewall Adaptive Security Appliance (ASA) and S](https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threat) ([json](https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threat.json)): high, closed, patched, started 2026-08-11, CVE-2026-20349
- [Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20316) ([json](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20316.json)): high, closed, patched, started 2026-07-29, CVE-2026-20316
- [Cisco Unified Communications Manager: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability](https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20230) ([json](https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20230.json)): high, closed, patched, started 2026-06-25, CVE-2026-20230
- [Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20262) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20262.json)): high, closed, patched, started 2026-06-15, CVE-2026-20262
- [Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20245) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20245.json)): high, closed, patched, started 2026-06-09, CVE-2026-20245
- [Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182.json)): high, closed, patched, started 2026-05-14, CVE-2026-20182
- [Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20133) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20133.json)): high, closed, patched, started 2026-04-20, CVE-2026-20133, CVE-2026-20128
- [Cisco Catalyst SD-WAN Manger: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manger-cve-2026-20122) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-manger-cve-2026-20122.json)): high, closed, patched, started 2026-04-20, CVE-2026-20122
- [Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20131) ([json](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20131.json)): high, closed, patched, started 2026-03-19, CVE-2026-20131
- [Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127.json)): high, closed, patched, started 2026-02-25, CVE-2026-20127
- [Cisco Catalyst SD-WAN zero-day campaign (CISA emergency directive)](https://pwn.watch/i/cisco-sdwan-february-2026-emergency-directive) ([json](https://pwn.watch/i/cisco-sdwan-february-2026-emergency-directive.json)): critical, closed, patched, started 2026-02-01
- [Cisco Unified Communications Manager: Cisco Unified Communications Products Code Injection Vulnerability](https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20045) ([json](https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20045.json)): high, closed, patched, started 2026-01-21, CVE-2026-20045
- [Cisco Multiple Products: Multiple Products Improper Input Validation Vulnerability](https://pwn.watch/i/cisco-multiple-products-cve-2025-20393) ([json](https://pwn.watch/i/cisco-multiple-products-cve-2025-20393.json)): critical, closed, patched, started 2025-12-17, CVE-2025-20393
- [Cisco IOS and IOS XE: IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability](https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2025-20352) ([json](https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2025-20352.json)): high, closed, patched, started 2025-09-29, CVE-2025-20352
- [Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense: 2 exploited vulnerabilities (CVE-2025-20333, CVE-2025-20362)](https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333) ([json](https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333.json)): critical, closed, patched, started 2025-09-25, CVE-2025-20333, CVE-2025-20362
- [Cisco Identity Services Engine: 2 exploited vulnerabilities (CVE-2025-20281, CVE-2025-20337)](https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281) ([json](https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281.json)): critical, closed, patched, started 2025-07-28, CVE-2025-20281, CVE-2025-20337
- [Cisco Smart Licensing Utility: Smart Licensing Utility Static Credential Vulnerability](https://pwn.watch/i/cisco-smart-licensing-utility-cve-2024-20439) ([json](https://pwn.watch/i/cisco-smart-licensing-utility-cve-2024-20439.json)): critical, closed, patched, started 2025-03-31, CVE-2024-20439
- [Cisco Small Business RV Series Routers: Small Business RV Series Routers Command Injection Vulnerability](https://pwn.watch/i/cisco-small-business-rv-series-routers-cve-2023-20118) ([json](https://pwn.watch/i/cisco-small-business-rv-series-routers-cve-2023-20118.json)): medium, closed, patched, started 2025-03-03, CVE-2023-20118
- [Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS)](https://pwn.watch/i/cisco-adaptive-security-appliance-asa-cve-2014-2120) ([json](https://pwn.watch/i/cisco-adaptive-security-appliance-asa-cve-2014-2120.json)): medium, closed, patched, started 2024-11-12, CVE-2014-2120
- [Cisco ASA and FTD Denial-of-Service](https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481) ([json](https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481.json)): medium, closed, patched, started 2024-10-23, CVE-2024-20481
- [Cisco NX-OS Command Injection](https://pwn.watch/i/cisco-nx-os-cve-2024-20399) ([json](https://pwn.watch/i/cisco-nx-os-cve-2024-20399.json)): medium, closed, patched, started 2024-07-01, CVE-2024-20399
- [Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign](https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359) ([json](https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359.json)): high, closed, patched, started 2024-04-24, CVE-2024-20353, CVE-2024-20359
- [Cisco ASA and FTD Information Disclosure](https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259) ([json](https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259.json)): high, closed, patched, started 2024-02-15, CVE-2020-3259
- [Cisco IOS and IOS XE: Group Encrypted Transport VPN Out-of-Bounds Write (CVE-2023-20109)](https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2023-20109) ([json](https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2023-20109.json)): medium, closed, patched, started 2023-10-10, CVE-2023-20109
- [Cisco IOS XE web UI zero-days: implants on tens of thousands of devices](https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198) ([json](https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198.json)): critical, closed, patched, started 2023-09-18, CVE-2023-20198, CVE-2023-20273
- [Cisco Adaptive Security Appliance and Firepower Threat Defense: Unauthorized Access (CVE-2023-20269)](https://pwn.watch/i/cisco-adaptive-security-appliance-and-threat-cve-2023-20269) ([json](https://pwn.watch/i/cisco-adaptive-security-appliance-and-threat-cve-2023-20269.json)): critical, closed, patched, started 2023-09-13, CVE-2023-20269