VendorsEdge, Infrastructure
Cisco
Cisco makes network routers and switches, the ASA and Firepower (Secure Firewall) appliances, Identity Services Engine, email security gateways and collaboration software.
- Response trend, 6 months
- Flat
- Open now
- None
- Latest incident
- 14 Oct 2026
- Incidents on record
- 25
Response to exploited bugs
90 range 83–96rank 1 of 10
Medium confidence, 14 reviewed zero-days
Fixing privately reported bugs
73 range 67–80rank 6 of 20
Medium confidence, 15 private reports
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: A- (90), from 14 reviewed zero-days in the last 36 months. Likely range 83 to 96.
- First fix within a day for 12 of 14 zero-days. The other 2 took a median of 17 days, longest 29 days.
- Every supported version fixed within a day for 8 of 12 zero-days. The other 4 took a median of 14 days, longest 29 days. 2 more have no public date for a fix to every version.
- First advisory within a day for all 14 zero-days. Its advisory said the bug was being exploited in 10 of 14.
- Fixing privately reported bugs: B- (73). Median 113 days from private report to fix (15 cases, 8 with a vendor fix date). 5 of 15 took longer than ZDI's 120-day deadline.
- 7 of 21 reviewed exploited bugs had a public fix before exploitation was reported. They do not count toward the response grade. For 3 of them, fixes for every version came later, up to 147 days.
Response to exploited bugs: sub-scores
- Time to first advisory14 of 14 zero-days within a day93A14 cases, high confidence, weight 20%
- Time to first fix12 of 14 zero-days within a day, longest 29 days88A−14 cases, medium confidence, weight 40%
- Time to fix all versions8 of 12 zero-days within a day, longest 29 days89A−12 cases, medium confidence, weight 30%
- OpennessAdvisories published as CSAF. 14 of 14 zero-days with a dated revision history. 13 of 13 advisories said the bug was exploited. 12 of 14 fixed zero-days with a public fix date for every version. 2 of 2 zero-days not fixed within a day had an advisory or mitigation within 72 hours.93A23 cases, high confidence, weight 10%
Fixing privately reported bugs: sub-score
- Private fix speedMedian 113 days from private report to fix (15 cases, 8 with a vendor fix date)73B−15 cases, medium confidence, weight 100%
Response fingerprint
Median of 14 graded zero-days. Vendor statement 0h, first fix <1h, all versions <1h.
Counts toward the response grade 14
- 30 Sep 2026Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability
- 16 Sep 2026Cisco Identity Services Engine Authentication Bypass Vulnerability
- 14 Sep 2026Cisco Secure Email Gateway SQL Injection Vulnerability
- 11 Aug 2026Cisco Secure Firewall ASA and FTD Software Remote Access SSL VPN Denial of Service Vulnerability
- 28 Jul 2026Cisco Secure Firewall Management Center Software Static Credential Vulnerability
- 4 Jun 2026Cisco Catalyst SD-WAN Controller, Manager, and Validator Authenticated Privilege Escalation Vulnerability
- 14 May 2026Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (control connection handshaking, May 2026)
- 4 Mar 2026Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
- 25 Feb 2026Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (UAT-8616 campaign)
- 21 Jan 2026Cisco Unified Communications Products Remote Code Execution Vulnerability
- 17 Dec 2025Cyberattacks against Cisco Secure Email Gateway and Secure Email and Web Manager (AsyncOS, UAT-9686)
- 25 Sep 2025Cisco Secure Firewall ASA and FTD VPN web server zero-days (ArcaneDoor: CVE-2025-20333 and CVE-2025-20362)
- 24 Sep 2025Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability
- 23 Oct 2024Cisco ASA and FTD Software Remote Access VPN Brute Force Denial of Service Vulnerability
Not graded 11: n-days, unreviewed timelines and end-of-life products
- 14 Oct 2026Cisco Secure Email Gateway Arbitrary File Write VulnerabilityNot graded: n-day
- 15 Jun 2026Cisco Catalyst SD-WAN Manager Arbitrary File Write VulnerabilityNot graded: n-day
- 3 Jun 2026Cisco Unified Communications Manager Server-Side Request Forgery VulnerabilityNot graded: n-day
- 4 Mar 2026Cisco Secure Firewall Management Center Software Authentication Bypass VulnerabilityNot graded: n-day
- 25 Feb 2026Cisco Catalyst SD-WAN Manager Vulnerabilities (February 2026: CVE-2026-20128, CVE-2026-20122, CVE-2026-20133)Not graded: n-day
- 25 Jun 2025Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities (CVE-2025-20281, CVE-2025-20337)Not graded: n-day
- 4 Sep 2024Cisco Smart Licensing Utility static administrative credential (cisco-sa-cslu-7gHMzWmw)Not graded: n-day
- 14 Mar 2023Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 Routers remote command execution (end of life, no fix)End of life: vendor advises replacementNot graded: end of life
- 28 Sep 2022Cisco SD-WAN Software CLI Privilege Escalation Vulnerability (2022), exploited in the UAT-8616 campaignNot graded: n-day
- 18 Mar 2014Cisco Adaptive Security Appliance WebVPN Login Page Cross-Site Scripting VulnerabilityNot graded: n-day
- 17 Sep 2008Cisco IOS 12.4 HTTP administration cross-site request forgeryEnd of life: vendor advises replacementNot graded: end of lifeNo response moments recorded
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
25 in 24 months, 2 with known ransomware use, 64% exploited before a fix
Show 13 more incidents
Private reports
Median 113 days, 33% over 120 days, 0 published unpatched
Bugs reported privately to Cisco by ZDI or Project Zero.
| Published | Advisory | Product | Days from report to fix or to publication. Tick: ZDI's 120-day deadline. | Patch at publication |
|---|---|---|---|---|
| 22 Oct 2026 | ZDI-26-788CVE-2026-20218 | Snort | 113to vendor fix, 21 Oct 2026 | Yes |
| 22 Sep 2026 | ZDI-26-719CVE-2026-20350 | ThousandEyes | 104to vendor fix, 16 Sep 2026 | Yes |
| 18 Sep 2026 | ZDI-26-717, ZDI-26-718CVE-2026-20211, CVE-2026-20235 | Identity Services Engine | 113to publication | Yes |
| 18 Sep 2026 | ZDI-26-709, ZDI-26-716CVE-2026-20176, CVE-2026-20242 | Secure Firewall Management Center; Identity Services Engine | 119to vendor fix, 16 Sep 2026 | Yes |
| 13 Aug 2026 | ZDI-26-579, ZDI-26-580CVE-2026-20181, CVE-2026-20190 | Identity Services Engine | 182to publication | Yes |
| 13 Aug 2026 | ZDI-26-581, ZDI-26-582CVE-2026-20147, CVE-2026-20148 | Identity Services Engine | 238to publication | Yes |
| 11 Aug 2026 | ZDI-26-533CVE-2026-20316 | Secure Firewall Management Center | 104to vendor fix, 29 Jul 2026 | Yes |
| 15 Jul 2026 | ZDI-26-421CVE-2026-20146 | Identity Services Engine | 188to publication | Yes |
| 28 Jan 2026 | ZDI-26-045, ZDI-26-046CVE-2026-20026, CVE-2026-20027 | Snort | 148to vendor fix, 7 Jan 2026 | Yes |
| 9 Jan 2026 | ZDI-26-019CVE-2026-20029 | Identity Services Engine | 148to publication | Yes |
Show all 15 private reports
| Published | Advisory | Product | Days from report to fix or to publication. Tick: ZDI's 120-day deadline. | Patch at publication |
|---|---|---|---|---|
| 27 Oct 2025 | ZDI-25-966CVE-2025-20359 | Snort | 104to vendor fix, 15 Oct 2025 | Yes |
| 17 Jul 2025 | ZDI-25-604, ZDI-25-605, ZDI-25-606, ZDI-25-607, ZDI-25-608CVE-2025-20282, CVE-2025-20283, CVE-2025-20284, CVE-2025-20285, CVE-2025-20337 | Identity Services Engine | 72to publication | Yes |
| 17 Jul 2025 | ZDI-25-609CVE-2025-20281 | Identity Services Engine | 76to publication | Yes |
| 1 May 2025 | ZDI-25-271, ZDI-25-272, ZDI-25-273, ZDI-25-274CVE-2025-20172 | IOS | 113to vendor fix, 5 Feb 2025 | Yes |
| 1 May 2025 | ZDI-25-270, ZDI-25-275, ZDI-25-276, ZDI-25-277, ZDI-25-278, ZDI-25-279, ZDI-25-280, ZDI-25-281CVE-2025-20169, CVE-2025-20170, CVE-2025-20171, CVE-2025-20173, CVE-2025-20174, CVE-2025-20175, CVE-2025-20176 | IOS | 120to vendor fix, 5 Feb 2025 | Yes |
Advisories changed after publication
18 shown, 0 without a revision noteRecorded in the revision history Cisco Secure Firewall Management Center Software Static Credential Vulnerability
Version table: 7 rows added and 6 rows removed. One new row reads "7.0 and earlier | 7.0.10".
- Fixed versions
- Version table rows
- Before7.0 | Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar; 7.2 | Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar; 7.4 | Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar; 7.6 | Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
- After7.0 and earlier | 7.0.10; 7.2 | 7.2.12; 7.4 | 7.4.8; 7.6 | 7.6.6
Recorded in the revision history Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
Version table: 7 rows added and 6 rows removed. One new row reads "7.0 and earlier | 7.0.10". Revision 2.5 date changed from 2026-09-09 to 2026-09-16.
- Fixed versions
- Revision date changed
- Version table rows
- Before7.0 | Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar; 7.2 | Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar; 7.4 | Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar; 7.6 | Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
- After7.0 and earlier | 7.0.10; 7.2 | 7.2.12; 7.4 | 7.4.8; 7.6 | 7.6.6
- Revision 2.5 date
- Before2026-09-09
- After2026-09-16
Show 16 more changes
Recorded in the revision history Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
Version table: 13 rows added and 12 rows removed. One new row reads "9.16 and earlier | 9.16.4.103".
- Fixed versions
- Version table rows
- Before9.16 1 | 89.16.4.50; 9.18 1 | 89.18.4.50; 9.20 | 9.20.4.235; 9.22 | 9.22.3.191
- After9.16 and earlier | 9.16.4.103; 9.18 | 9.18.4.94; 9.20 | 9.20.4.49; 9.22 | 9.22.3.26
Recorded in the revision history Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
Advisory now says the bug is exploited (earlier version: vendor not aware).
- Exploitation status
- Exploitation status
- Beforevendor not aware of exploitation
- Aftervendor aware of exploitation
Recorded in the revision history Cisco Secure Firewall Management Center Software Static Credential Vulnerability
Revision 1.3 date changed from 2026-08-05 to 2026-08-03.
- Revision date changed
- Revision 1.3 date
- Before2026-08-05
- After2026-08-03
Recorded in the revision history Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
Revision 2.0 date changed from 2026-07-29 to 2026-07-31.
- Revision date changed
- Revision 2.0 date
- Before2026-07-29
- After2026-07-31
Recorded in the revision history Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability
Version table: 1 row added. One new row reads "20.18.2.2 and earlier | 20.18.3.1".
- Fixed versions
- Version table rows
- Beforenot present
- After20.18.2.2 and earlier | 20.18.3.1
Verbatim wording. Removed text is struck through. Added text is bold. BeforeCisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager,andCatalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability Cisco Security Advisory Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager,andCatalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability High Advisory ID: cisco-sa-sdwan-privesc-4uxFrdzx First Published: 2026 June 4 22:27 GMT Last UpdateAftert Fixed Release 20.9.9.1 and earlier | 20.9.9.2 20.12.7.1 and earlier | 20.12.7.2 20.15.4.4 and earlier | 20.15.4.5 20.15.5.2 and earlier | 20.15.5.3 20.18.2.2 and earlier | 20.18.3.1 20.18.3 | 20.18.3.1 26.1.1.1 and earlier | 26.1.1.2 The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory. Exploitatio
Recorded in the revision history Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability
Advisory now says the bug is exploited (earlier version: vendor not aware).
- Exploitation status
- Exploitation status
- Beforevendor not aware of exploitation
- Aftervendor aware of exploitation
Recorded in the revision history Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability
Version table: 2 rows added and 2 rows removed. One new row reads "20.9.9.1 and earlier | 20.9.9.2".
- Fixed versions
- Version table rows
- Before20.9.9.1 and earlier | Future release; 20.12.7.1 and earlier | Future release
- After20.9.9.1 and earlier | 20.9.9.2; 20.12.7.1 and earlier | 20.12.7.2
Recorded in the revision history Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Revision 1.0 date changed from 2026-05-14 to 2026-05-27.
- Revision date changed
- Revision 1.0 date
- Before2026-05-14
- After2026-05-27
Recorded in the revision history Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
Advisory now says the bug is exploited (earlier version: vendor not aware).
- Exploitation status
- Exploitation status
- Beforevendor not aware of exploitation
- Aftervendor aware of exploitation
Recorded in the revision history Cisco Catalyst SD-WAN Vulnerabilities
Advisory now says the bug is exploited (earlier version: vendor not aware). Version table: 2 rows added and 2 rows removed. One new row reads "20.9 | 20.9.8.2".
- Exploitation status
- Fixed versions
- Exploitation status
- Beforevendor not aware of exploitation
- Aftervendor aware of exploitation
- Version table rows
- Before20.9 | 20.9.8.2 (Estimated release February 27, 2026); 20.12.5 20.12.6 | 20.12.5.3 20.12.6.1
- After20.9 | 20.9.8.2; 20.12 | 20.12.5.3 20.12.6.1
Recorded in the revision history Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Version table: 2 rows added and 2 rows removed. One new row reads "20.9 | 20.9.8.2".
- Fixed versions
- Version table rows
- Before20.9 | 20.9.8.2 (Estimated release February 27, 2026); 20.12.5 20.12.6 | 20.12.5.3 20.12.6.1
- After20.9 | 20.9.8.2; 20.12 | 20.12.5.3 20.12.6.1
Recorded in the revision history Cisco SD-WAN Software Privilege Escalation Vulnerabilities
Advisory now says the bug is exploited (earlier version: vendor not aware).
- Exploitation status
- Exploitation status
- Beforevendor not aware of exploitation
- Aftervendor aware of exploitation
Recorded in the revision history Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability
Revision 2.2 date changed from 2025-10-02 to 2025-10-06.
- Revision date changed
- Revision 2.2 date
- Before2025-10-02
- After2025-10-06
Recorded in the revision history Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities
Advisory now says the bug is exploited (earlier version: vendor not aware).
- Exploitation status
- Exploitation status
- Beforevendor not aware of exploitation
- Aftervendor aware of exploitation
Recorded in the revision history Cisco Smart Licensing Utility Vulnerabilities
Advisory now says the bug is exploited (earlier version: vendor not aware).
- Exploitation status
- Exploitation status
- Beforevendor not aware of exploitation
- Aftervendor aware of exploitation
Recorded in the revision history Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers Vulnerabilities
Advisory now says the bug is exploited (earlier version: vendor not aware).
- Exploitation status
- Exploitation status
- Beforevendor not aware of exploitation
- Aftervendor aware of exploitation
Grade history
Response to exploited bugs: score at the end of each month.
Show as a table
| Month | Score | Grade |
|---|---|---|
| Nov 2025 | 83 | B+ |
| Dec 2025 | 80 | B+ |
| Jan 2026 | 80 | B |
| Feb 2026 | 82 | B+ |
| Mar 2026 | 83 | B+ |
| Apr 2026 | 83 | B+ |
| May 2026 | 85 | B+ |
| Jun 2026 | 85 | A− |
| Jul 2026 | 86 | A− |
| Aug 2026 | 87 | A− |
| Sep 2026 | 90 | A− |
| Oct 2026 | 90 | A− |
Channels
Get Cisco's own alerts
- EmailCisco cust-security-announce mailing listSign up for the vendor’s security notification emails.
- RSSCisco Security Advisories RSSAdd the advisory feed to a feed reader or chat integration.
- CSAFCisco PSIRT CSAF 2.0 provider metadataPoint a CSAF-aware tool at the provider metadata.
- APICisco publication listing JSON (keyless)Poll the advisory API from your own tooling.
- BlueskyCisco on BlueskyFollow the account.
- BlueskyCisco Talos on BlueskyFollow the account.
- XCisco on XFollow the account and turn on notifications.
- BlogCisco Security blog RSSSubscribe to the security blog.
- Advisory pageCisco Security Advisories indexCheck the advisory page. It has no push channel.
What we watch
- CSAFCisco PSIRT CSAF 2.0 provider metadata
- BlueskyCisco on Bluesky
- BlueskyCisco Talos on Bluesky
See sources and health for when each was last read.
Grade A minus.