Cisco Enterprise Nfv Infrastructure Software vulnerabilities

35 CVEs affecting Cisco Enterprise Nfv Infrastructure Software, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-20096, published 2026-04-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-32433: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability, published 2025-04-16. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2025-06-09. EPSS: 98.8% chance of exploitation in the next 30 days. Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated…
CVE-2021-34746, published 2021-09-02. Critical severity, CVSS 9.8. EPSS: 17.7% chance of exploitation in the next 30 days. A vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to…
CVE-2022-20780, published 2022-05-04. High severity, CVSS 7.4. EPSS: 11.2% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that…
CVE-2022-20777, published 2022-05-04. Critical severity, CVSS 9.9. EPSS: 11.1% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that…
CVE-2022-20779, published 2022-05-04. High severity, CVSS 8.8. EPSS: 10.5% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that…
CVE-2020-3470, published 2020-11-18. Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days. Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges. The…
CVE-2018-0279, published 2018-05-17. High severity, CVSS 8.8. EPSS: 4.4% chance of exploitation in the next 30 days. A vulnerability in the Secure Copy Protocol (SCP) server of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to access the shell of the underlying…
CVE-2019-1971, published 2019-08-08. Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days. A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command injection attack and execute arbitrary…
CVE-2019-1894, published 2019-07-06. High severity, CVSS 7.2. EPSS: 3.5% chance of exploitation in the next 30 days. A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with administrator privileges to overwrite or read arbitrary files on the…
CVE-2019-1895, published 2019-08-07. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to access the VNC…

Latest

CVE-2026-20096, published 2026-04-01. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system…
CVE-2026-20095, published 2026-04-01. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system…
CVE-2026-20090, published 2026-04-01. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the…
CVE-2026-20089, published 2026-04-01. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the…
CVE-2026-20088, published 2026-04-01. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the…
CVE-2026-20087, published 2026-04-01. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the…
CVE-2026-20085, published 2026-04-01. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. This…
CVE-2022-20655, published 2024-11-15. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to…
CVE-2022-20929, published 2023-03-10. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, local attacker to provide an unauthentic upgrade file for…