Cisco IOS XE Software vulnerabilities

18 CVEs affecting Cisco IOS XE Software, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-20311, published 2026-08-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-20225, published 2025-08-14. Medium severity, CVSS 5.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall Adaptive Security Appliance (ASA) Software, and Secure Firewall Threat…
CVE-2025-20239, published 2025-08-14. High severity, CVSS 8.6. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall Adaptive Security Appliance (ASA) Software, and Secure Firewall Threat…
CVE-2025-20334, published 2025-09-24. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system. …
CVE-2026-20086, published 2026-03-25. High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family could allow an…
CVE-2025-20316, published 2025-09-24. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthenticated, remote attacker to bypass a…
CVE-2026-20308, published 2026-08-05. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to perform a denial of service (DoS) attack against an…
CVE-2025-20240, published 2025-09-24. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected…
CVE-2026-20113, published 2026-03-25. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a carriage return…
CVE-2026-20114, published 2026-03-25. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that…
CVE-2026-20125, published 2026-03-25. High severity, CVSS 7.7. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly,…

Latest

CVE-2026-20311, published 2026-08-05. Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an…
CVE-2026-20115, published 2026-03-25. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulnerability is due to a device…
CVE-2026-20112, published 2026-03-25. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site…
CVE-2026-20110, published 2026-03-25. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists…
CVE-2026-20083, published 2026-03-25. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated, local attacker with low privileges to cause a denial of service (DoS) condition…