Read the docs

Cisco

Records7060All Threatist records
Exploited (KEV)107In CISA KEV
CVSS critical694CVSS 9.0–10.0
CVSS high2793CVSS 7.0–8.9

Exploited now

Cisco records in CISA KEV
TI-2026-82192 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability Priority CRITICAL 94KEV 2026-10-29TI-2026-74174 Cisco Secure Email Gateway Relative Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-10-14TI-2026-53490 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability Priority CRITICAL 100KEV 2026-09-30TI-2026-53488 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability Priority CRITICAL 100KEV 2026-09-16TI-2026-53489 Cisco Secure Email Gateway SQL Injection Vulnerability Priority CRITICAL 100KEV 2026-09-14TI-2026-16292 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability Priority CRITICAL 100KEV 2026-09-09

Components

Products in the NVD configurations · select one to filter the records
Ios 618 records CRITICAL Ios Xe 562 records CRITICAL Adaptive Security Appliance Software 355 records CRITICAL Secure Firewall Threat Defense 277 records CRITICAL Nx-os 275 records CRITICAL Unified Communications Manager 239 records CRITICAL Ios Xr 200 records CRITICAL Identity Services Engine 198 records CRITICAL

Records

56 records in Asyncos · all components

TI-2026-74174 CVE-2026-76519

Arbitrary file write in Cisco Secure Email Gateway via AMP feature

Priority CRITICAL 100KEV

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06227 Published 2026-10-14 No fix listed CWE-23
TI-2026-53489 CVE-2026-76461 · GHSA-jwpf-jww6-h6vr

Cisco Secure Email Gateway SQL Injection Vulnerability

Priority CRITICAL 100KEV

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.4016 Published 2026-09-14 No fix listed CWE-89
TI-2025-14683 CVE-2025-20393 · GHSA-mrgj-cg36-fgq8

Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability

Priority CRITICAL 100KEV

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system c…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.32392 Published 2025-12-17 No fix listed CWE-20
TI-2021-13698 CVE-2021-34698 · GHSA-vj66-rqm3-j78p

Cisco Web Security Appliance Proxy Service Denial of Service Vulnerability

Priority MEDIUM 48

A vulnerability in the proxy service of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service (DoS) condition on an af…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01432 Published 2021-10-06 No fix listed CWE-401
TI-2018-11020 CVE-2018-15460 · GHSA-q66v-34fh-vw9m

Cisco Email Security Appliance URL Filtering Denial of Service Vulnerability

Priority MEDIUM 48

A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 p…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.02516 Published 2019-01-10 No fix listed CWE-20
TI-2019-01567 CVE-2019-1947 · GHSA-57m9-xcr9-qv37

Cisco Email Security Appliance Denial of Service Vulnerability

Priority MEDIUM 47

A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 pe…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01918 Published 2020-09-23 No fix listed CWE-20
TI-2022-05430 CVE-2022-20871 · GHSA-rw66-6rgj-mwjh

Cisco Secure Web Appliance Privilege Escalation Vulnerability

Priority MEDIUM 42

A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to perform a…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01917 Published 2024-11-15 No fix listed CWE-78
TI-2022-05212 CVE-2022-20653 · GHSA-p3pv-g3c9-4qf8

Cisco Email Security Appliance DNS Verification Denial of Service Vulnerability

Priority MEDIUM 42

A vulnerability in the DNS-based Authentication of Named Entities (DANE) email verification component of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01826 Published 2022-02-17 No fix listed CWE-399
TI-2021-01086 CVE-2021-1359 · GHSA-9x2v-q9rg-r4cc

Cisco Web Security Appliance Privilege Escalation Vulnerability

Priority MEDIUM 42

A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and elevate privileges to root.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01879 Published 2021-07-08 No fix listed CWE-112
TI-2019-11999 CVE-2019-15956 · GHSA-8pmp-qg97-8gmp

Cisco Web Security Appliance Unauthorized Device Reset Vulnerability

Priority MEDIUM 42

A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform an unauthorized system reset on an affected device…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00981 Published 2019-11-26 No fix listed CWE-284
TI-2021-13740 CVE-2021-34741 · GHSA-mcrm-m53h-jvp2

Cisco Email Security Appliance Denial of Service Vulnerability

Priority MEDIUM 41

A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to perform a denial of service (DoS) attack against an af…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01289 Published 2021-11-04 No fix listed CWE-770
TI-2022-05427 CVE-2022-20868 · GHSA-24wm-cqx7-gv2j

Hard-coded credentials in Cisco Secure Web Appliance

Priority LOW 39

A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an authenticated, remote attacker to elevate privileg…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00797 Published 2022-11-03 No fix listed CWE-321
TI-2024-13316 CVE-2024-20383 · GHSA-pr8j-5v55-885c

Cisco Secure Email and Web Manager Stored Cross-Site Scripting Vulnerability

Priority LOW 38

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interfac…

CVSS 3.1HIGH 8.4 Network High privileges User interaction EPSS 0.00351 Published 2024-05-15 No fix listed CWE-79
TI-2019-01506 CVE-2019-1884 · GHSA-jpm3-6rm2-fhgg

Cisco Web Security Appliance Web Proxy Denial of Service Vulnerability

Priority LOW 37

A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected de…

CVSS 3.0HIGH 7.7 Network Low privileges No interaction EPSS 0.01485 Published 2019-07-04 Fixed in 10.5.5-005 CWE-20
TI-2021-01290 CVE-2021-1566 · GHSA-9pg8-7479-p4jw

Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability

Priority LOW 36

A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an unauthenticated, re…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.0067 Published 2021-06-16 No fix listed CWE-296
TI-2021-01260 CVE-2021-1534 · GHSA-86vv-w52w-qq85

Cisco Email Security Appliance URL Filtering Bypass Vulnerability

Priority LOW 36

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected…

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.01067 Published 2021-10-06 No fix listed CWE-20
TI-2018-00070 CVE-2018-0095 · GHSA-24rf-59x9-98x7

Access control flaw in Cisco Email Security and Content Security Management Appliance

Priority LOW 36

A vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance (ESA) and Content Security Management Appliance (SMA) could allow an authenticated, local attacker to escalate their privileg…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00399 Published 2018-01-18 No fix listed CWE-264
TI-2025-14484 CVE-2025-20184 · GHSA-g9mx-x5c2-8c9j

Cisco Secure Email and Web Manager and Secure Web Appliance Command Injection Vulnerability

Priority LOW 35

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an authenticated, remote attacker to perform command injection att…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00863 Published 2025-02-05 No fix listed CWE-20
TI-2024-13357 CVE-2024-20429 · GHSA-9h6c-2f95-gmf7

Injection in Cisco Secure Email

Priority LOW 35

A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary system commands on an affected device.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00621 Published 2024-07-17 No fix listed CWE-74
TI-2020-02919 CVE-2020-3368 · GHSA-vr98-485w-gvwg

Cisco Email Security Appliance URL Filtering Bypass Vulnerability

Priority LOW 35

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected…

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.01413 Published 2020-06-18 No fix listed CWE-20
TI-2020-02918 CVE-2020-3367 · GHSA-w9wf-7g3r-xgx7

Cisco Secure Web Appliance Privilege Escalation Vulnerability

Priority LOW 35

A vulnerability in the log subscription subsystem of Cisco AsyncOS for the Cisco Secure Web Appliance (formerly Web Security Appliance) could allow an authenticated, local attacker to perform command injection and elevat…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00797 Published 2020-11-18 No fix listed CWE-78
TI-2017-08994 CVE-2017-12215 · GHSA-wx6j-j2jv-h7c4

Improper input validation in Cisco Email Security Appliance

Priority LOW 35

A vulnerability in the email message filtering feature of Cisco AsyncOS Software for the Cisco Email Security Appliance could allow an unauthenticated, remote attacker to cause an affected device to run out of memory and…

CVSS 3.0HIGH 7.1 Local No auth No interaction EPSS 0.01734 Published 2017-09-21 No fix listed CWE-20
Load more
Open these records in search →