Cisco

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Cisco product.

RSS Feeds for Cisco security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Cisco products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Cisco Sorted by Most Security Vulnerabilities since 2018

Cisco IOS XE323 vulnerabilities
Newer version of Cisco IOS Operating System built on linux.

Cisco Internetwork Operating System (IOS)211 vulnerabilities
Cisco Internetwork Operating System (IOS) is a family of network operating systems used on many Cisco Systems routers and current Cisco network switches.

Cisco Adaptive Security Appliance Software206 vulnerabilities

Cisco Firepower Threat Defense194 vulnerabilities

Cisco Secure Firewall Management Center182 vulnerabilities

Cisco Identity Services Engine142 vulnerabilities

Cisco Firepower Management Center141 vulnerabilities

Cisco Small Business Rv Series Router Firmware137 vulnerabilities

Cisco Adaptive Security Appliance129 vulnerabilities

Cisco Catalyst Sd Wan Manager87 vulnerabilities

Cisco Nx Os84 vulnerabilities

Cisco Unified Communications Manager83 vulnerabilities

Cisco Sd Wan Vmanage77 vulnerabilities

Cisco Ios Xr64 vulnerabilities

Cisco Data Center Network Manager64 vulnerabilities

Cisco Webex Meetings57 vulnerabilities

Cisco Sd Wan56 vulnerabilities

Cisco Prime Infrastructure53 vulnerabilities

Cisco Firepower Threat Defense Software48 vulnerabilities

Cisco Unified Computing System47 vulnerabilities

Cisco Identity Services Engine Software46 vulnerabilities

Cisco Unified Contact Center Express45 vulnerabilities

Cisco Evolved Programmable Network Manager38 vulnerabilities

Cisco Unified Communications Manager Im Presence Service36 vulnerabilities

Cisco Wireless Lan Controller Software33 vulnerabilities

Cisco Unity Connection33 vulnerabilities

Cisco Telepresence Video Communication Server33 vulnerabilities

Cisco Email Security Appliance33 vulnerabilities

Cisco Enterprise Nfv Infrastructure Software33 vulnerabilities

Cisco Anyconnect Secure Mobility Client29 vulnerabilities

Cisco Telepresence Collaboration Endpoint28 vulnerabilities

Cisco Dna Center27 vulnerabilities

Cisco Application Policy Infrastructure Controller26 vulnerabilities

Cisco Roomos25 vulnerabilities

Cisco Asyncos25 vulnerabilities

Cisco Nexus Dashboard25 vulnerabilities

Cisco Web Security Appliance25 vulnerabilities

Cisco Catalyst Center24 vulnerabilities

Cisco Jabber23 vulnerabilities

Cisco Sd Wan Manager19 vulnerabilities

Cisco Common Services Platform Collector19 vulnerabilities

Cisco Aironet Access Point Software18 vulnerabilities

Cisco Smart Software Manager On Prem18 vulnerabilities

Cisco Unified Intelligence Center18 vulnerabilities

Cisco Iot Field Network Director16 vulnerabilities

Cisco Finesse16 vulnerabilities

Cisco Prime Collaboration Provisioning16 vulnerabilities

Cisco Expressway16 vulnerabilities

Cisco Webex Business Suite15 vulnerabilities

Cisco Webex Teams15 vulnerabilities

Cisco Cyber Vision15 vulnerabilities

Cisco Integrated Management Controller14 vulnerabilities

Cisco Enterprise Chat And Email14 vulnerabilities

Cisco Hyperflex Hx Data Platform14 vulnerabilities

Cisco Clamav13 vulnerabilities

Cisco Secure Endpoint13 vulnerabilities

Cisco Nexus Dashboard Fabric Controller13 vulnerabilities

Cisco Industrial Network Director12 vulnerabilities

Cisco Unified Contact Center Enterprise11 vulnerabilities

Cisco Unified Computing System Director11 vulnerabilities

Cisco Network Services Orchestrator11 vulnerabilities

Cisco Ios Xe Sd Wan10 vulnerabilities

Cisco Packaged Contact Center Enterprise10 vulnerabilities

Cisco Emergency Responder10 vulnerabilities

Cisco Content Security Management Appliance10 vulnerabilities

Cisco Broadworks9 vulnerabilities

Cisco Telepresence Management Suite9 vulnerabilities

Cisco Secure Client9 vulnerabilities

Cisco Secure Network Analytics8 vulnerabilities

Cisco Secure Endpoint Private Cloud8 vulnerabilities

Cisco Prime Collaboration Assurance8 vulnerabilities

Cisco Secure Email And Web Manager8 vulnerabilities

Cisco Identity Services Engine Passive Identity Connector7 vulnerabilities

Cisco Intersight Virtual Appliance7 vulnerabilities

Recent Cisco Security Advisories

Advisory	Title	Published
2026-04-01	Cisco Evolved Programmable Network Manager Improper Authorization Vulnerability	April 1, 2026
2026-04-01	Cisco Nexus Dashboard Configuration Backup REST API Unauthorized Access Vulnerability	April 1, 2026
2026-04-01	Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability	April 1, 2026
2026-04-01	Cisco Integrated Management Controller Command Injection and Remote Code Execution Vulnerabilities	April 1, 2026
2026-04-01	Cisco Integrated Management Controller Authentication Bypass Vulnerability	April 1, 2026
2026-04-01	Cisco Nexus Dashboard and Nexus Dashboard Insights Server-Side Request Forgery Vulnerability	April 1, 2026
2026-04-01	Cisco Nexus Dashboard Insights Arbitrary File Write Vulnerability	April 1, 2026
2026-04-01	Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability	April 1, 2026
2026-04-01	Cisco Integrated Management Controller Cross-Site Scripting Vulnerabilities	April 1, 2026
2026-03-25	Cisco IOS XE Software for Catalyst 9000 Series Switches DHCP Snooping Denial of Service Vulnerability	March 25, 2026

Known Exploited Cisco Vulnerabilities

The following Cisco vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewa	Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. CVE-2026-20131 Exploit Probability: 0.8%	March 19, 2026
Cisco SD-WAN Path Traversal Vulnerability	Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. CVE-2022-20775 Exploit Probability: 0.4%	February 25, 2026
Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability	Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affec CVE-2026-20127 Exploit Probability: 39.7%	February 25, 2026
Cisco Unified Communications Products Code Injection Vulnerability	Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. CVE-2026-20045 Exploit Probability: 1.3%	January 21, 2026
Cisco Multiple Products Improper Input Validation Vulnerability	Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. CVE-2025-20393 Exploit Probability: 6.6%	December 17, 2025
Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability	Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system. CVE-2025-20352 Exploit Probability: 2.7%	September 29, 2025
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Mis	Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333. CVE-2025-20362 Exploit Probability: 46.9%	September 25, 2025
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buf	Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362. CVE-2025-20333 Exploit Probability: 10.6%	September 25, 2025
Cisco Identity Services Engine Injection Vulnerability	Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. CVE-2025-20337 Exploit Probability: 0.9%	July 28, 2025
Cisco Identity Services Engine Injection Vulnerability	Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. CVE-2025-20281 Exploit Probability: 28.2%	July 28, 2025
Cisco Smart Licensing Utility Static Credential Vulnerability	Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials. CVE-2024-20439 Exploit Probability: 86.3%	March 31, 2025
Cisco Small Business RV Series Routers Command Injection Vulnerability	Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data. CVE-2023-20118 Exploit Probability: 3.8%	March 3, 2025
Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability	Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. CVE-2014-2120 Exploit Probability: 63.9%	November 12, 2024
Cisco ASA and FTD Denial-of-Service Vulnerability	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service. CVE-2024-20481 Exploit Probability: 11.1%	October 24, 2024
Cisco NX-OS Command Injection Vulnerability	Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device. CVE-2024-20399 Exploit Probability: 0.8%	July 2, 2024
Cisco ASA and FTD Privilege Escalation Vulnerability	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root. CVE-2024-20359 Exploit Probability: 0.2%	April 24, 2024
Cisco ASA and FTD Denial of Service Vulnerability	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition. CVE-2024-20353 Exploit Probability: 24.4%	April 24, 2024
Cisco ASA and FTD Information Disclosure Vulnerability	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. CVE-2020-3259 Exploit Probability: 69.7%	February 15, 2024
Cisco IOS XE Web UI Unspecified Vulnerability	Cisco IOS XE contains an unspecified vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity. CVE-2023-20273 Exploit Probability: 92.4%	October 23, 2023
Cisco IOS XE Web UI Command Injection Vulnerability	Cisco IOS XE contains a command injection vulnerability in the web user interface that could allow a remote, authenticated attacker to inject commands that can be executed as the root user. CVE-2021-1435 Exploit Probability: 0.3%	October 19, 2023

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 6 known exploited Cisco vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

Top 10 Riskiest Cisco Vulnerabilities

Based on the current exploit probability, these Cisco vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.

Rank	CVE	EPSS	Vulnerability
1	CVE-2020-3452	94.5%	Cisco Adaptive Security Appliance and Cisco Fire Power Threat Defense directory traversal sensitive
2	CVE-2018-0296	94.4%	Cisco Adaptive Security Appliance Firepower Threat Defense Denial-of-Service/Directory Traversal vul
3	CVE-2019-1653	94.4%	Cisco RV320 and RV325 Routers Improper Access Control Vulnerability (COVID-19-CTI list)
4	CVE-2021-1497	94.4%	Cisco HyperFlex HX Command Injection Vulnerabilities
5	CVE-2017-3881	94.3%	Cisco IOS and IOS XE Remote Code Execution Vulnerability
6	CVE-2021-1498	94.2%	Cisco HyperFlex HX Command Injection Vulnerabilities
7	CVE-2023-20198	94.0%	Cisco IOS XE Web UI Privilege Escalation Vulnerability
8	CVE-2020-3580	93.4%	Cisco ASA and FTD XSS Vulnerabilities
9	CVE-2018-0171	93.0%	Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability
10	CVE-2019-1652	93.0%	Cisco Small Business Routers Improper Input Validation Vulnerability

By the Year

In 2026 there have been 109 vulnerabilities in Cisco with an average score of 6.5 out of ten. Last year, in 2025 Cisco had 218 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Cisco in 2026 could surpass last years number. Last year, the average CVE base score was greater by 0.17

Year	Vulnerabilities	Average Score
2026	109	6.52
2025	218	6.69
2024	366	6.74
2023	271	6.83
2022	323	6.91
2021	620	6.84
2020	354	6.85
2019	524	6.78
2018	373	7.51

It may take a day or so for new Cisco vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Cisco Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-20090	Apr 01, 2026	Cisco IMC Web UI Stored XSS via Authenticated Admin A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.	Enterprise Nfv Infrastructure Software Unified Computing System
CVE-2026-20089	Apr 01, 2026	Cisco IMC Web UI Stored XSS via Authenticated Admin A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.	Enterprise Nfv Infrastructure Software Unified Computing System
CVE-2026-20088	Apr 01, 2026	Cisco IMC Web UI Authenticated Remote Stored XSS A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.	Enterprise Nfv Infrastructure Software Unified Computing System
CVE-2026-20087	Apr 01, 2026	Cisco IMC Web UI Stored XSS Enables Browser Script Exec (CVE-2026-20087) A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.	Enterprise Nfv Infrastructure Software Unified Computing System
CVE-2026-20174	Apr 01, 2026	Auth RCE via Metadata Update in Cisco Nexus Dashboard Insights A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights could allow an authenticated, remote attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient validation of the metadata update file. An attacker could exploit this vulnerability by crafting a metadata update file and manually uploading it to an affected device. A successful exploit could allow the attacker to write arbitrary files to the underlying operating system as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. Note: Manual uploading of metadata files is typical for Air-Gap environments but not for Cisco Intersight Cloud connected devices. However, the manual upload option exists for both deployments.	Nexus Dashboard Nexus Dashboard Insights
CVE-2026-20160	Apr 01, 2026	Cisco SSM On-Prem RCE via exposed internal API A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected SSM On-Prem host. This vulnerability is due to the unintentional exposure of an internal service. An attacker could exploit this vulnerability by sending a crafted request to the API of the exposed service. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.	Smart Software Manager On Prem
CVE-2026-20155	Apr 01, 2026	Cisco EPNM REST API Auth Bypass: View Sensitive Session Data A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker with low privileges to access sensitive information that they are not authorized to access. This vulnerability is due to improper authorization checks on a REST API endpoint of an affected device. An attacker could exploit this vulnerability by querying the affected endpoint. A successful exploit could allow the attacker to view session information of active Cisco EPNM users, including users with administrative privileges, which could result in the affected device being compromised.	Evolved Programmable Network Manager
CVE-2026-20151	Apr 01, 2026	CVE-2026-20151: Privilege Escalation via Improper Credential Exposure in Cisco SSM On-Prem A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to the improper transmission of sensitive user information. An attacker could exploit this vulnerability by sending a crafted message to an affected Cisco SSM On-Prem host and retrieving session credentials from subsequent status messages. A successful exploit could allow the attacker to elevate privileges on the affected system from low to administrative. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of System User. Note: This vulnerability exposes information only about users who logged in to the Cisco SSM On-Prem host using the web interface and who are currently logged in. SSH sessions are not affected.	Smart Software Manager On Prem
CVE-2026-20096	Apr 01, 2026	Cisco IMC Web CLI Command Injection (CVE-2026-20096) A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user. Cisco has assigned this vulnerability a Security Impact Rating (SIR) of High, rather than Medium as the score indicates, because additional security implications could occur once the attacker has become root.	Enterprise Nfv Infrastructure Software Unified Computing System
CVE-2026-20097	Apr 01, 2026	Cisco IMC Web Mgt Interface RCE (CVE-2026-20097) A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user. Cisco has assigned this vulnerability a SIR of High rather than Medium as the score indicates because additional security implications could occur when the attacker becomes root.	Unified Computing System
CVE-2026-20094	Apr 01, 2026	Cisco IMC Authenticated Remote Cmd Injection via Web UI (Read-Only Privilege) A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with read-only privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.	Unified Computing System
CVE-2026-20095	Apr 01, 2026	Command Injection in Cisco IMC Web UI (CVE-2026-20095) A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user. Cisco has assigned this vulnerability a Security Impact Rating (SIR) of High, rather than Medium as the score indicates, because additional security implications could occur once the attacker has become root.	Enterprise Nfv Infrastructure Software Unified Computing System
CVE-2026-20093	Apr 01, 2026	Cisco IMC Auth Bypass via Password Change Exploit A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system as Admin. This vulnerability is due to incorrect handling of password change requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to bypass authentication, alter the passwords of any user on the system, including an Admin user, and gain access to the system as that user.	Enterprise Nfv Infrastructure Software Unified Computing System
CVE-2026-20085	Apr 01, 2026	Reflected XSS in Cisco IMC Web Interface A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.	Enterprise Nfv Infrastructure Software Unified Computing System
CVE-2026-20042	Apr 01, 2026	Root RCE via Cisco Nexus Dashboard Backup Auth Leak (CVE-2026-20042) A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or Config-only backup files to access sensitive information. This vulnerability exists because authentication details are included in the encrypted backup files. An attacker with a valid backup file and encryption password from an affected device could decrypt the backup file. The attacker could then use the authentication details in the backup file to access internal-only APIs on the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.	Nexus Dashboard
CVE-2026-20041	Apr 01, 2026	Cisco Nexus Dashboard SSRF via HTTP input validation A vulnerability in Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by persuading an authenticated user of the device management interface to click a crafted link. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device to an attacker-controlled server. The attacker could then execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.	Nexus Dashboard Nexus Dashboard Insights
CVE-2026-20108	Mar 25, 2026	Cisco SDWAN Manager Authenticated XSS in Web UI A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of the web-based management interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.	Catalyst Sd Wan Manager
CVE-2026-20112	Mar 25, 2026	Cisco IOS XE XSS in Web-Based Management Interface A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.	IOS XE
CVE-2026-20113	Mar 25, 2026	Cisco IOS XE CRLF Injection in IOx Management Interface A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a carriage return line feed (CRLF) injection attack against a user. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by sending crafted packets to an affected device. A successful exploit could allow the attacker to arbitrarily inject log entries, manipulate the structure of log files, or obscure legitimate log events.	IOS XE
CVE-2026-20114	Mar 25, 2026	Privilege Escalation via Lobby Ambassador API in Cisco IOS XE A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users. This vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges.	IOS XE
CVE-2026-20115	Mar 25, 2026	Cisco Meraki IOS XE Remote Config Leak via Insecure Tunnel A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information.	IOS XE
CVE-2026-20083	Mar 25, 2026	SCP Server DoS via Malformed SSH on Cisco IOS XE A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated, local attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of a malformed SCP request. An attacker could exploit this vulnerability by issuing a crafted command through SSH. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.	IOS XE
CVE-2026-20110	Mar 25, 2026	Cisco IOS XE CLI DoS via start maintenance cmd A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because incorrect privileges are associated with the start maintenance command. An attacker could exploit this vulnerability by accessing the management CLI of the affected device as a low-privileged user and using the start maintenance command. A successful exploit could allow the attacker to put the device in maintenance mode, which shuts down interfaces, resulting in a denial of service (DoS) condition. In case of exploitation, a device administrator can connect to the CLI and use the stop maintenance command to restore operations.	IOS XE
CVE-2026-20104	Mar 25, 2026	Cisco IOS XE Bootloader Code Execution (CVE-2026-20104) A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches, Cisco Catalyst ESS9300 Embedded Series Switches, Cisco Catalyst IE9310 and IE9320 Rugged Series Switches, and Cisco IE3500 and IE3505 Rugged Series Switches could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to an affected device to execute arbitrary code at boot time and break the chain of trust. This vulnerability is due to insufficient validation of software at boot time. An attacker could exploit this vulnerability by manipulating the loaded binaries on an affected device to bypass some of the integrity checks that are performed during the boot process. A successful exploit could allow the attacker to execute code that bypasses the requirement to run Cisco-signed images. Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates because this vulnerability allows an attacker to bypass a major security feature of a device.	IOS XE
CVE-2026-20004	Mar 25, 2026	Cisco IOS XE TLS Memory Exhaust DoS via EAP A vulnerability in the TLS library of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust the available memory of an affected device. This vulnerability is due to improper management of memory resources during TLS connection setup. An attacker could exploit this vulnerability by repeatedly triggering the conditions that cause the memory increase. This could be done in a variety of ways, such as by repeatedly attempting Extensible Authentication Protocol (EAP) authentication when local EAP is enabled on an affected device or by using a machine-in-the-middle attack and resetting TLS connections between the affected device and other devices. A successful exploit could allow the attacker to exhaust the available memory on an affected device, resulting in an unexpected reload and a denial of service (DoS) condition.	IOS XE
CVE-2026-20125	Mar 25, 2026	Cisco IOS/IOS XE HTTP Server DoS via malformed requests A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malformed HTTP requests to an affected device. A successful exploit could allow the attacker to cause a watchdog timer to expire and the device to reload, resulting in a DoS condition. To exploit this vulnerability, the attacker must have a valid user account.	Internetwork Operating System (IOS) IOS XE
CVE-2026-20012	Mar 25, 2026	Cisco IOS/ASA IKEv2 Packet Parsing Memory Leak DoS A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition on an affected device. This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device. A successful exploit of Cisco IOS Software and IOS XE Software could allow the attacker to cause the affected device to reload, resulting in a DoS condition. A successful exploit of Cisco Secure Firewall ASA Software and Secure FTD Software could allow the attacker to partially exhaust system memory, resulting in system instability, such as the inability to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.	Internetwork Operating System (IOS) Adaptive Security Appliance IOS XE And others...
CVE-2026-20086	Mar 25, 2026	Cisco IOS XE Wireless CNTRL DoS via malformed CAPWAP A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of a malformed CAPWAP packet. An attacker could exploit this vulnerability by sending a malformed CAPWAP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition.	IOS XE
CVE-2026-20084	Mar 25, 2026	Cisco IOS XE DoS via BOOTP VLAN Leakage A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packets to be forwarded between VLANs, resulting in a denial of service (DoS) condition. This vulnerability is due to improper handling of BOOTP packets on Cisco Catalyst 9000 Series Switches. An attacker could exploit this vulnerability by sending BOOTP request packets to an affected device. A successful exploit could allow an attacker to forward BOOTP packets from one VLAN to another, resulting in BOOTP VLAN leakage and potentially leading to high CPU utilization. This makes the device unreachable (either through console or remote management) and unable to forward traffic, resulting in a DoS condition. Note: This vulnerability can be exploited with either unicast or broadcast BOOTP packets. There are workarounds that address this vulnerability.	IOS XE
CVE-2026-20118	Mar 11, 2026	Cisco NCS 5500/5700 NPU DoS via EPNI Aligner Int A vulnerability in the handling of an Egress Packet Network Interface (EPNI) Aligner interrupt in Cisco IOS XR Software for Cisco Network Convergence System (NCS) 5500 Series with NC57 line cards and Cisco NCS 5700 Routers and Cisco IOS XR Software for Third Party Software could allow an unauthenticated, remote attacker to cause the network processing unit (NPU) and ASIC to stop processing, preventing traffic from traversing the interface. This vulnerability is due to the corruption of packets in specific cases when an EPNI Aligner interrupt is triggered while an affected device is experiencing heavy transit traffic. An attacker could exploit this vulnerability by sending a continuous flow of crafted packets to an interface of the affected device. A successful exploit could allow the attacker to cause persistent, heavy packet loss, resulting in a denial of service (DoS) condition. Note: If active exploitation of this vulnerability is suspected, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider. Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. This change was made because the affected device operates within a critical network segment where compromise could lead to significant disruption or exposure, thereby elevating the overall risk beyond the base technical severity.	Internetwork Operating System (IOS)
CVE-2026-20117	Mar 11, 2026	CVE-2026-20117: Unauth XSS in Cisco CCX Web UI A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability exists because the web-based management interface of an affected system does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.	Unified Contact Center Express
CVE-2026-20116	Mar 11, 2026	Cisco Finesse UI XSS in WebUI Allows Remote Attacker Exec A vulnerability in the web-based management interface of  Cisco Finesse, Cisco Packaged Contact Center Enterprise (Packaged CCE), Cisco Unified Contact Center Enterprise (Unified CCE), Cisco Unified Contact Center Express (Unified CCX), and Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability exists because the web-based management interface of an affected system does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.	Unified Contact Center Express
CVE-2026-20046	Mar 11, 2026	Privilege Escalation via CLI Task Group Misassignment in Cisco IOS XR A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device. This vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks.	Internetwork Operating System (IOS)
CVE-2026-20074	Mar 11, 2026	Cisco IOS XR IS-IS Process Crash via Malformed Packets A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) multi-instance routing feature of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the IS-IS process to restart unexpectedly. This vulnerability is due to insufficient input validation of ingress IS-IS packets. An attacker could exploit this vulnerability by sending crafted IS-IS packets to an affected device after forming an adjacency. A successful exploit could allow the attacker to cause the IS-IS process to restart unexpectedly, resulting in a temporary loss of connectivity to advertised networks and a denial of service (DoS) condition. Note: The IS-IS protocol is a routing protocol. To exploit this vulnerability, an attacker must be Layer 2-adjacent to the affected device and must have formed an adjacency.	Internetwork Operating System (IOS)
CVE-2026-20040	Mar 11, 2026	Cisco IOS XR CLI Local Authenticated Privilege Escalation via Argument Validation A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the prompt. A successful exploit could allow the attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system.	Internetwork Operating System (IOS)
CVE-2026-20064	Mar 04, 2026	Cisco FTD CLI DoS via Improper Input Validation A vulnerability in of Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to cause the device to unexpectedly reload, causing a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied input. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the CLI prompt. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
CVE-2026-20025	Mar 04, 2026	OSPF LSU Heap Corruption DoS in Cisco Secure Firewall ASA/FTD A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. To exploit this vulnerability, the attacker must have the OSPF secret key. This vulnerability is due to insufficient input validation when processing OSPF link-state update (LSU) packets. An attacker could exploit this vulnerability by sending crafted OSPF LSU packets. A successful exploit could allow the attacker to corrupt the heap, causing the device to reload, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20024	Mar 04, 2026	Cisco Secure Firewall ASA/FTD OSPF DoS via Auth Attack A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. To exploit this vulnerability, the attacker must have the OSPF secret key. This vulnerability is due to heap corruption in OSPF when parsing packets. An attacker could exploit this vulnerability by sending crafted packets to the OSPF service. A successful exploit could allow the attacker to corrupt the heap, causing the affected device to reload, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20023	Mar 04, 2026	Cisco ASA/FTD OSPF Memory Corruption Causing DoS A vulnerability in the OSPF protocol of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to corrupt memory on an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to memory corruption when parsing OSPF protocol packets. An attacker could exploit this vulnerability by sending crafted OSPF packets to an affected device. A successful exploit could allow the attacker to cause memory corruption causing the affected device to reboot, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20022	Mar 04, 2026	DoS via OSPF LSU Overflow in Cisco Secure Firewall ASA/FTD A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition when OSPF canonicalization debug is enabled by using the command debug ip ospf canon. This vulnerability is due to insufficient input validation when processing OSPF LSU packets. An attacker could exploit this vulnerability by sending crafted unauthenticated OSPF packets. A successful exploit could allow the attacker to write to memory outside of the packet data, causing the device to reload, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20021	Mar 04, 2026	OSPF Authenticated Adjacent DoS via Memory Exhaustion in Cisco ASA/FTD A vulnerability in the OSPF protocol of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, adjacent attacker to exhaust memory on an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to improperly validating input by the OSPF protocol when parsing packets. An attacker could exploit this vulnerability by by sending crafted OSPF packets to an affected device. A successful exploit could allow the attacker to exhaust memory on the affected device, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20020	Mar 04, 2026	Cisco Secure Firewall ASA/FTD OSPF DoS via Buffer Overflow A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. If OSPF authentication is enabled, the attacker must know the secret key to exploit this vulnerability. This vulnerability is due to insufficient input validation when processing OSPF update packets. An attacker could exploit this vulnerability by sending crafted OSPF update packets. A successful exploit could allow the attacker to create a buffer overflow, causing the affected device to reload, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20016	Mar 04, 2026	Cisco FXOS CLI Auth Local RCE (root) A vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. To exploit this vulnerability, the attacker must have valid administrative credentials on an affected device. This vulnerability is due to insufficient input validation of user-supplied command arguments. An attacker could exploit this vulnerability by submitting crafted input for specific CLI commands. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.
CVE-2026-20073	Mar 04, 2026	Cisco ASA/FTD: Cluster Replication RMEM Bypass (CVE-2026-20073) A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should be denied through an affected device. This vulnerability is due to improper error handling when an affected device that is joining a cluster runs out of memory while replicating access control rules. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.	Adaptive Security Appliance
CVE-2026-20102	Mar 04, 2026	Cisco Secure Firewall ASA/FTD XSS via Unvalidated SAML 2.0 SSO A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the SAML feature and access sensitive, browser-based information. This vulnerability is due to insufficient input validation of multiple HTTP parameters. An attacker could exploit this vulnerability by persuading a user to access a malicious link. A successful exploit could allow the attacker to conduct a reflected XSS attack through an affected device.	Adaptive Security Appliance
CVE-2026-20070	Mar 04, 2026	VPN Web Services XSS in Cisco Secure Firewall ASA/FTD A vulnerability in the VPN web services component of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a browser that is accessing an affected device.  This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by persuading a user to follow a link to a malicious website that is designed to submit malicious input to the affected application. A successful exploit could allow the attacker to execute arbitrary HTML or script code in the browser in the context of the VPN web server.	Adaptive Security Appliance
CVE-2026-20069	Mar 04, 2026	VPN Webservices XSS in Cisco Secure Firewall ASA/FTD Remote Attack A vulnerability in the VPN web services component of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct browser-based attacks against users of an affected device. This vulnerability is due to improper validation of HTTP requests. An attacker could exploit this vulnerability by persuading a user to visit a website that is designed to pass malicious HTTP requests to a device that is running Cisco Secure Firewall ASA Software or Cisco Secure FTD Software and has web services endpoints supporting VPN features enabled. A successful exploit could allow the attacker to reflect malicious input from the affected device to the browser that is in use and conduct browser-based attacks, including cross-site scripting (XSS) attacks. The attacker is not able to directly impact the affected device.	Adaptive Security Appliance
CVE-2026-20068	Mar 04, 2026	Cisco Snort 3 D.E. DoS via Malformed RPC Parsing Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to incomplete error checking when parsing remote procedure call (RPC) data. An attacker could exploit this vulnerability by sending crafted RPC packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.	Cyber Vision
CVE-2026-20067	Mar 04, 2026	Cisco Snort 3 DoS via MDNS HTTP Header Parsing Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.  This vulnerability is due to incomplete error checking when parsing the Multicast DNS fields of the HTTP header. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.	Cyber Vision
CVE-2026-20066	Mar 04, 2026	DoS via JSTokenizer Exploit in Cisco Snort 3 Detection Engine Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to an error in the JSTokenizer normalization logic when the HTTP inspection normalizes JavaScript. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection that is parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine restarts unexpectedly. JSTokenizer is not enabled by default.