Cisco Umbrella Virtual Appliance vulnerabilities

5 CVEs affecting Cisco Umbrella Virtual Appliance, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-20246, published 2026-06-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-20773, published 2022-04-21. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to impersonate a VA. This vulnerability is due…
CVE-2022-20922, published 2022-11-15. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multiple Cisco products could allow an unauthenticated, remote attacker to bypass the…
CVE-2017-12350, published 2017-11-16. High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in Cisco Umbrella Insights Virtual Appliances 2.1.0 and earlier could allow an authenticated, local attacker to log in to an affected virtual appliance with root privileges. The…
CVE-2017-6679, published 2017-12-01. Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days. The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel (SSH) which auto initiated from the customer's appliance to Cisco's SSH Hubs in…
CVE-2026-20246, published 2026-06-17. Medium severity, CVSS 6.0. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability in the vmadmin CLI of Cisco Umbrella Virtual Appliance could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to…