Cisco IOS XE

Name: Cisco IOS XE
Brand: Cisco

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

2critical6high1medium0low

updated 2026-10-27

vulnerabilities (56)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-20352US	—OT critical	41.5% (99th)	KEV	no fix	2025-09-24	≤ vers:unknown/*
CVE-2025-20171US	—	0.78% (56th)	—	3.11.12E (Mar 2025)	2025-02-05	5 versions
CVE-2025-20170US	—	0.78% (56th)	—	3.11.12E (Mar 2025)	2025-02-05	5 versions
CVE-2025-20169US	—	0.78% (56th)	—	17.15.3 (Mar 2025)	2025-02-05	5 versions
CVE-2025-20176US	—	0.76% (55th)	—	16.12.13 (Mar 2025)	2025-02-05	5 versions
CVE-2025-20175US	—	0.76% (55th)	—	17.15.3 (Mar 2025)	2025-02-05	5 versions
CVE-2025-20174US	—	0.76% (55th)	—	16.12.13 (Mar 2025)	2025-02-05	5 versions
CVE-2025-20173US	—	0.76% (55th)	—	3.11.12E (Mar 2025)	2025-02-05	5 versions
CVE-2025-20172US	—	0.76% (55th)	—	16.12.13 (Mar 2025)	2025-02-05	5 versions
CVE-2026-20026US	—	0.67% (52nd)	—	26.1.1	2026-01-07	< 26.1.1
CVE-2025-20221US	critical9.1	0.64% (50th)	—	no fix	2025-05-07	3 versions
CVE-2026-20027US	—	0.60% (48th)	—	26.1.1	2026-01-07	< 26.1.1
CVE-2026-20272US	—	0.57% (47th)	—	17.12.8	2026-08-05	6 versions
CVE-2026-20263US	—	0.57% (47th)	—	17.18.4	2026-08-05	6 versions
CVE-2026-20005US	—	0.52% (44th)	—	17.18.3	2026-03-04	4 versions
CVE-2025-20334US	—	0.50% (43rd)	—	no fix	2025-09-24	≤ vers:unknown/*
CVE-2026-20124US	—	0.50% (43rd)	—	17.18.4a	2026-08-05	6 versions
CVE-2026-20067US	—	0.48% (41st)	—	17.15.5	2026-03-04	4 versions
CVE-2026-20066US	—	0.48% (41st)	—	17.12.7	2026-03-04	4 versions
CVE-2026-20273US	—	0.47% (40th)	—	17.18.4	2026-08-05	6 versions
CVE-2026-20271US	—	0.47% (40th)	—	17.12.8	2026-08-05	6 versions
CVE-2026-20270US	—	0.47% (40th)	—	17.18.4a	2026-08-05	6 versions
CVE-2026-20269US	—	0.47% (40th)	—	17.18.4	2026-08-05	6 versions
CVE-2026-20268US	—	0.47% (40th)	—	26.1.2	2026-08-05	6 versions
CVE-2026-20057US	—	0.46% (40th)	—	17.15.5	2026-03-04	4 versions
CVE-2026-20054US	—	0.46% (40th)	—	17.12.7	2026-03-04	4 versions
CVE-2025-20315US	—	0.44% (38th)	—	no fix	2025-09-24	≤ vers:unknown/*
CVE-2026-20068US	—	0.44% (38th)	—	26.1.1	2026-03-04	4 versions
CVE-2026-20053US	—	0.44% (38th)	—	17.12.7	2026-03-04	4 versions
CVE-2026-20308US	—	0.44% (38th)	—	17.18.4a	2026-08-05	6 versions
CVE-2025-20160US	—	0.43% (37th)	—	no fix	2025-09-24	≤ vers:unknown/*
CVE-2026-20058US	—	0.41% (35th)	—	17.18.3	2026-03-04	4 versions
CVE-2025-20327US	—	0.40% (34th)	—	no fix	2025-09-24	≤ vers:unknown/*
CVE-2025-20312US	—	0.40% (34th)	—	no fix	2025-09-24	≤ vers:unknown/*
CVE-2026-20065US	—	0.39% (33rd)	—	26.1.1	2026-03-04	4 versions
CVE-2026-20267US	—	0.38% (32nd)	—	17.18.4a	2026-08-05	6 versions
CVE-2025-20316US	—	0.34% (27th)	—	no fix	2025-09-24	≤ vers:unknown/*
CVE-2025-20240US	—	0.34% (27th)	—	no fix	2025-09-24	≤ vers:unknown/*
CVE-2025-20338US	medium6.7	0.30% (22nd)	—	no fix	2025-09-24	≤ vers:unknown/*
CVE-2026-76467US	high7.5	0.25% (16th)	—	17.15.6	2026-10-07	4 versions
CVE-2026-20311US	—	0.25% (17th)	—	17.9.10	2026-08-05	6 versions
CVE-2025-20191US	—	0.24% (15th)	—	no fix	2025-05-07	≤ Software for WLC <16.12
CVE-2025-20149US	—	0.24% (15th)	—	no fix	2025-09-24	≤ vers:unknown/*
CVE-2026-76468US	high8.2	0.23% (13th)	—	26.1.2	2026-10-07	4 versions
CVE-2025-20311US	—	0.20% (10th)	—	no fix	2025-09-24	≤ vers:unknown/*
CVE-2025-20293US	—	0.20% (10th)	—	no fix	2025-09-24	≤ vers:unknown/*
CVE-2026-76464US	critical9.6	0.19% (9th)	—	26.1.2	2026-10-07	4 versions
CVE-2026-76470US	high8.8	0.18% (8th)	—	17.18.4.1	2026-10-07	4 versions
CVE-2025-20313US	—	0.18% (8th)	—	no fix	2025-09-24	≤ vers:unknown/*
CVE-2025-20314US	—	0.16% (5th)	—	no fix	2025-09-24	≤ vers:unknown/*

showing 50 of 56

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-805Buffer Access with Incorrect Length Value10 CVEs
CWE-248Uncaught Exception5 CVEs
CWE-284Improper Access Control3 CVEs
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')3 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer2 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs
CWE-664Improper Control of a Resource Through its Lifetime2 CVEs

sources (2)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)42 CVEs
NLNCSC-NL (CSAF)21 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan