Cisco Asyncos vulnerabilities

56 CVEs affecting Cisco Asyncos, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-76519, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-20393: Cisco Multiple Products Improper Input Validation Vulnerability, published 2025-12-17. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2025-12-17. EPSS: 32.4% chance of exploitation in the next 30 days. A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to…
CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability, published 2026-09-14. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-09-14. EPSS: 29.5% chance of exploitation in the next 30 days. A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the…
CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability, published 2026-10-14. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-10-14. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating…
CVE-2018-15460, published 2019-01-10. High severity, CVSS 8.6. EPSS: 2.5% chance of exploitation in the next 30 days. A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization…
CVE-2016-1461, published 2016-08-01. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. Cisco AsyncOS on Email Security Appliance (ESA) devices through 9.7.0-125 allows remote attackers to bypass malware detection via a crafted attachment in an e-mail message, aka Bug ID CSCuz14932.
CVE-2019-1947, published 2020-09-23. High severity, CVSS 8.6. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization…
CVE-2022-20871, published 2024-11-15. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an authenticated, remote…
CVE-2021-1359, published 2021-07-08. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and elevate…
CVE-2019-1983, published 2020-09-23. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) could allow an…
CVE-2018-0087, published 2018-03-08. Medium severity, CVSS 5.6. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability in the FTP server of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to log in to the FTP server of the device without a valid password. The…

Latest

CVE-2020-3122, published 2025-03-04. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to obtain sensitive…
CVE-2025-20185, published 2025-02-05. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance…
CVE-2025-20184, published 2025-02-05. High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an authenticated, remote attacker to perform…
CVE-2025-20183, published 2025-02-05. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote…
CVE-2025-20180, published 2025-02-05. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an authenticated, remote attacker to…
CVE-2021-1425, published 2024-11-18. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an authenticated, remote attacker to access…