Short answer: this page lists every Cisco vulnerability that CISA added to its Known Exploited Vulnerabilities (KEV) catalog in 2026, meaning there is evidence of exploitation in the wild, with the fix and a link to our Daily Brief coverage where we wrote about it. If you run any product in the table, treat its row as a patch-now item.
How to use this page
- Match products first. Compare the Product column with your asset inventory. Only rows for products and versions you run matter to you.
- Patch newest and internet-facing first. Rows are sorted by the date CISA added them. Recently added flaws on exposed systems are usually the most urgent.
- Use the Fix column. It shows CISA’s required action and links to Cisco’s advisory (or the NVD entry when CISA lists no advisory) for fixed versions and workarounds.
- Check for compromise, not just patch status. Where we covered a flaw, the Our coverage link has exposure checks and what to hunt for. Patching does not remove an attacker who is already in.
- U.S. federal agencies must remediate KEV entries by the due date CISA sets; everyone else can use KEV as a priority list.
Cisco vulnerabilities exploited in 2026
As of 2026-10-08 (CISA KEV catalog version 2026.10.08), CISA lists 18 Cisco vulnerabilities added to the Known Exploited Vulnerabilities catalog in 2026. CyberExperts has covered 7 of them in the Daily Brief. Newest additions are first.
| CVE | Product | Added to KEV | Fix | Our coverage |
|---|---|---|---|---|
| CVE-2026-76504 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | 2026-09-30 | Apply the vendor's updates or mitigations. Vendor advisory | Thursday’s brief: SD-WAN admin bypass due Saturday, then TeamViewer, OpenSSL, MikroTik Your SD-WAN Manager has a Saturday deadline — and attackers already have admin |
| CVE-2026-76460 | Identity Services Engine Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | 2026-09-16 | Apply the vendor's updates or mitigations. Vendor advisory | Cisco ISE CVE-2026-76460: Unauth Management Bypass to Root — KEV Due September 19 |
| CVE-2026-76461 | Secure Email Gateway Cisco Secure Email Gateway SQL Injection Vulnerability | 2026-09-14 | Apply the vendor's updates or mitigations. Vendor advisory | Cisco Secure Email Gateway CVE-2026-76461: Unauth SQL Injection to Root — KEV Due Wednesday |
| CVE-2026-20079 | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-09-09 | Apply the vendor's updates or mitigations. Vendor advisory | Cisco FMC CVE-2026-20079: Sandworm-linked and Qilin clusters hit firewall management for root The 5-Minute Cyber Brief: September 11, 2026 Cisco Secure FMC CVE-2026-20079: Auth Bypass to Root — Patch ≠ Clean |
| CVE-2026-20349 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability | 2026-08-11 | Apply the vendor's updates or mitigations. Vendor advisory | Cisco warns of ASA and FTD VPN flaw exploited to crash devices CISA Adds Three Known Exploited Vulnerabilities to Catalog The 5-Minute Cyber Brief: August 12, 2026 |
| CVE-2026-20316 | Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability (known ransomware use) | 2026-07-29 | Apply the vendor's updates or mitigations. Vendor advisory | The 5-Minute Cyber Brief: July 30, 2026 The 5-Minute Cyber Brief: July 31, 2026 CISA Adds One Known Exploited Vulnerability to Catalog |
| CVE-2008-4128 | IOS Cisco IOS Cross-Site Request Forgery Vulnerability | 2026-07-13 | Apply the vendor's updates or mitigations. Vendor advisory | CISA Adds One Known Exploited Vulnerability to Catalog |
| CVE-2026-20230 | Unified Communications Manager Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability | 2026-06-25 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-20262 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability | 2026-06-15 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-20245 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability | 2026-06-09 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-20182 | Catalyst SD-WAN Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability | 2026-05-14 | Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Vendor advisory | Not covered yet |
| CVE-2026-20133 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | 2026-04-20 | Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Vendor advisory | Not covered yet |
| CVE-2026-20128 | Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability | 2026-04-20 | Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Vendor advisory | Not covered yet |
| CVE-2026-20122 | Catalyst SD-WAN Manger Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability | 2026-04-20 | Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Vendor advisory | Not covered yet |
| CVE-2026-20131 | Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability (known ransomware use) | 2026-03-19 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-20127 | Catalyst SD-WAN Controller and Manager Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability | 2026-02-25 | Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Vendor advisory | Not covered yet |
| CVE-2022-20775 | SD-WAN Cisco SD-WAN Path Traversal Vulnerability | 2026-02-25 | Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Vendor advisory | Not covered yet |
| CVE-2026-20045 | Unified Communications Manager Cisco Unified Communications Products Code Injection Vulnerability | 2026-01-21 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
How this page is built
The table is compiled from CISA’s Known Exploited Vulnerabilities catalog and our own Daily Brief coverage, and we refresh it as CISA adds entries. A missing row means CISA has not added that flaw to KEV this year, not that it is safe to ignore. Always confirm fixed versions in the vendor advisory.