FAIL › dossier
Cisco Systems Inc.
COMPANY FEDRAMP MARKETFedRAMP provider · · dossier confidence 80%
Cisco Systems Inc. is a major public technology vendor with a significant security track record in 2026 characterized by multiple critical zero-day vulnerabilities, particularly in SD-WAN Manager and Unified CM products, with some vulnerabilities remaining unpatched for extended periods.
PROFILE
CategoryTechnology VendorWhat they doCisco Systems Inc. is a global technology company that designs, manufactures, and sells networking hardware, software, and telecommunications equipment.Founded1984HQSan Jose, California, USAOwnershipPublic
Websitehttps://www.cisco.com ↗
SECURITY POSTURE
Cisco has demonstrated a pattern of releasing multiple critical and high-severity zero-day vulnerabilities in 2026, particularly within the SD-WAN Manager product line, with some vulnerabilities remaining unpatched for extended periods.
Notable failures
- CVE-2026-20230: Cisco Unified CM SSRF vulnerability allowing unauthenticated root escalation
- CVE-2026-20182: Cisco Catalyst SD-WAN Controller bypass authentication for admin privileges
- CVE-2026-20131: Cisco FMC and SCC critical RCE via Java deserialization
- CVE-2026-20245: Cisco SD-WAN Manager zero-day command injection with no patch available
- CVE-2026-20133: Cisco FMC and SCC critical RCE via untrusted data deserialization
- CVE-2026-20128: Cisco Catalyst SD-WAN Manager storing passwords in recoverable format
Patterns: Repeated unpatched zero-day vulnerabilities in SD-WAN Manager; High-severity RCE vulnerabilities in Cisco Unified CM and FMC; Authentication bypass vulnerabilities in SD-WAN Controller
FAILURE HISTORY · 60
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2026-02-25 | CVE-2022-20775 | high | Cisco SD-WAN CLI exposed to path traversal, allowing local attackers to escalate privileges and execute commands as root. |
| 2026-01-21 | CVE-2026-20045 | high | Cisco UC products allow remote code execution. |
| 2025-07-28 | CVE-2025-20337 | high | Cisco ISE API RCE |
| 2026-10-14 | CVE-2026-76519 | high | An unauthenticated remote attacker can write arbitrary files on the underlying OS via a relative path traversal flaw in Cisco Secure Email Gateway. |
| 2026-09-30 | CVE-2026-76504 | high | An unauthenticated remote attacker could escalate to admin privileges via improper URI encoding in Cisco Catalyst SD-WAN Manager. |
| 2026-09-14 | CVE-2026-76461 | high | Cisco Secure Email Gateway suffered an unpatched SQL injection flaw allowing remote attackers to execute arbitrary root commands. |
| 2026-09-09 | CVE-2026-20079 | high | An unauthenticated remote attacker could bypass authentication and execute scripts to gain root access on Cisco FMC/SCC devices. |
| 2026-07-29 | CVE-2026-20316 | high | Cisco FMC shipped with a hardcoded password allowing unauthenticated remote login to sensitive data. |
| 2026-06-25 | CVE-2026-20230 | high | Cisco Unified CM SSRF vulnerability allows unauthenticated remote attackers to write files to the OS and escalate to root. |
| 2026-05-14 | CVE-2026-20182 | high | Cisco Catalyst SD-WAN Controller allows unauthenticated remote attackers to bypass authentication and gain administrative privileges. |
| 2026-03-19 | CVE-2026-20131 | critical | Cisco FMC and SCC allow unauthenticated remote attackers to execute arbitrary Java code as root via deserialization of untrusted data. |
| 2023-09-13 | CVE-2023-20269 | critical | Cisco ASA and Firepower Threat Defense suffered an unpatched unauthorized access vulnerability allowing remote brute-force attacks and clientless SSL VPN sessions. |
| 2022-10-24 | CVE-2020-3153 | critical | Cisco AnyConnect for Windows mishandles directory paths, allowing attackers with valid credentials to copy malicious files to arbitrary locations with system-level privileges. |
| 2022-10-24 | CVE-2020-3433 | critical | Cisco AnyConnect's IPC channel allowed attackers with valid Windows credentials to execute SYSTEM-level code via DLL hijacking. |
| 2022-03-25 | CVE-2018-0125 | high | Cisco VPN routers had an unauthenticated remote code execution flaw in their web interface allowing attackers full system control. |
| 2022-03-25 | CVE-2017-3881 | high | Cisco IOS and IOS XE suffered a remote code execution vulnerability in the Cluster Management Protocol allowing unauthenticated attackers to execute elevated code or reload devices. |
| 2022-03-03 | CVE-2018-0151 | high | An unauthenticated remote attacker could execute arbitrary code with elevated privileges in Cisco IOS and IOS XE QoS subsystems. |
| 2022-03-03 | CVE-2022-20700 | high | Cisco Small Business RV routers suffered a stack-based buffer overflow allowing remote code execution and privilege escalation. |
| 2022-03-03 | CVE-2022-20699 | high | Cisco Small Business RV routers suffered a stack-based buffer overflow allowing remote code execution and privilege escalation. |
| 2021-11-03 | CVE-2020-3118 | high | Cisco IOS XR improperly validates CDP input, allowing adjacent attackers to execute admin code or reload devices. |
| 2021-11-03 | CVE-2018-0171 | high | Cisco IOS and IOS XE Smart Install allows unauthenticated remote attackers to execute code, causing device reloads, DoS, or full compromise. |
| 2024-02-15 | CVE-2020-3259 | critical | Cisco ASA/FTD memory disclosure flaw leaked secrets via invalid URL parsing in specific AnyConnect/WebVPN setups. |
| 2022-03-25 | CVE-2018-0147 | high | Cisco ACS suffered an unpatched Java deserialization vulnerability allowing remote command execution, now on CISA's KEV list. |
| 2022-03-03 | CVE-2018-0175 | high | A format string vulnerability in Cisco IOS XR/IOS XE LLDP allowed unauthenticated adjacent attackers to execute arbitrary code with elevated privileges. |
| 2022-03-03 | CVE-2018-0180 | high | A decades-old Cisco IOS DoS vulnerability (CVE-2018-0180) remains actively exploited in the wild, proving that unpatched legacy hardware is a critical compliance failure. |
| 2022-03-03 | CVE-2019-1652 | high | Cisco Small Business RV320/RV325 routers had an improper input validation flaw allowing authenticated remote attackers to execute arbitrary commands. |
| 2022-03-03 | CVE-2018-0167 | high | An unauthenticated adjacent attacker could exploit a buffer overflow in Cisco IOS XR LLDP to execute arbitrary code or cause a DoS. |
| 2022-03-03 | CVE-2022-20701 | high | Cisco Small Business RV routers suffered a stack-based buffer overflow allowing remote code execution and privilege escalation. |
| 2022-03-03 | CVE-2022-20703 | high | Cisco Small Business RV routers suffered a stack-based buffer overflow allowing arbitrary code execution and privilege escalation. |
| 2022-03-03 | CVE-2022-20708 | high | Cisco Small Business RV Series routers suffered a stack-based buffer overflow allowing arbitrary code execution and privilege escalation. |
| 2022-03-03 | CVE-2017-6743 | high | An authenticated remote attacker could execute code via the SNMP subsystem in Cisco IOS and IOS XE software. |
| 2022-03-03 | CVE-2017-6738 | high | Cisco IOS and IOS XE SNMP subsystems allowed authenticated remote attackers to execute arbitrary code via CVE-2017-6738. |
| 2022-03-03 | CVE-2017-6740 | high | An authenticated remote attacker could execute code on Cisco IOS and IOS XE devices via an SNMP vulnerability. |
| 2022-03-03 | CVE-2017-6739 | high | An authenticated remote attacker could execute code or reload a Cisco IOS/XE device via an SNMP vulnerability. |
| 2022-03-03 | CVE-2017-12240 | high | An unauthenticated remote attacker could execute arbitrary code and gain full control of Cisco IOS and IOS XE systems via a DHCP relay subsystem vulnerability. |
| 2022-03-03 | CVE-2017-6736 | high | Cisco IOS and IOS XE software contained an SNMP remote code execution vulnerability allowing authenticated attackers to execute arbitrary code remotely. |
| 2021-11-03 | CVE-2020-3161 | high | Cisco IP phones had an unpatched remote code execution vulnerability exploited in the wild, allowing attackers to gain root access. |
| 2021-11-03 | CVE-2021-1498 | high | Cisco HyperFlex HX installer VM had insufficient input validation allowing command execution as tomcat8 user. |
| 2021-11-03 | CVE-2021-1497 | high | Cisco HyperFlex HX installer VM suffered a command injection flaw allowing root-level code execution. |
| 2026-09-16 | CVE-2026-76460 | high | An unauthenticated remote attacker can bypass Cisco ISE's web management interface via incorrect privileged API use. |
| 2022-05-24 | CVE-2016-6366 | high | Cisco ASA's SNMP code had a buffer overflow allowing remote code execution or system reloads. |
| 2022-05-23 | CVE-2022-20821 | high | Cisco IOS XR software health check opens TCP port 6379 by default, allowing attackers to access the Redis instance running within the NOSi container. |
| 2022-03-03 | CVE-2017-6737 | high | Cisco IOS and IOS XE software suffered a remote code execution vulnerability in its SNMP subsystem that allowed authenticated attackers to execute arbitrary code remotely. |
| 2022-03-03 | CVE-2017-6744 | high | Cisco IOS software contained an SNMP remote code execution vulnerability allowing authenticated attackers to execute arbitrary code or reload systems via crafted packets. |
| 2026-02-25 | CVE-2026-20127 | high | Cisco's SD-WAN devices had an unpatched authentication bypass flaw allowing remote attackers to gain admin access. |
| 2025-12-17 | CVE-2025-20393 | high | Cisco gear with AsyncOS, Web Manager, and Secure Email suffered remote code execution due to improper input validation, allowing root access on affected systems. |
| 2025-09-29 | CVE-2025-20352 | high | Cisco IOS and IOS XE SNMP RCE DoS |
| 2025-09-25 | CVE-2025-20333 | high | Cisco ASA and FTD suffered remote code execution due to a buffer overflow, actively exploited in the wild. |
| 2025-09-25 | CVE-2025-20362 | high | Cisco firewalls with missing auth vuln exploited in wild |
| 2025-07-28 | CVE-2025-20281 | high | Cisco ISE API flaw allows RCE and root privileges |
| 2023-10-23 | CVE-2023-20273 | high | Cisco IOS XE Web UI Command Injection Vulnerability |
| 2023-10-16 | CVE-2023-20198 | high | Cisco IOS XE Web UI privilege escalation vulnerability allows remote, unauthenticated attackers to gain control of devices. |
| 2023-10-10 | CVE-2023-20109 | high | Cisco IOS and IOS XE Group Encrypted Transport VPN out-of-bounds write vulnerability allows remote code execution. |
| 2023-05-19 | CVE-2016-6415 | high | Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability |
| 2023-05-19 | CVE-2004-1464 | high | Cisco IOS Denial-of-Service Vulnerability |
| 2023-04-19 | CVE-2017-6742 | high | Cisco IOS and IOS XE SNMP RCE vulnerability exploited in the wild |
| 2022-03-03 | CVE-2018-0173 | high | Cisco IOS and IOS XE Software suffered an unpatched improper input validation vulnerability in DHCPv4 packet handling that caused denial-of-service and was actively exploited in the wild. |
| 2022-03-03 | CVE-2018-0174 | high | Cisco IOS XE DHCP option 82 improper input validation allows denial-of-service via unpatched, actively exploited vulnerability. |
| 2022-03-03 | CVE-2017-6627 | high | Cisco IOS and IOS XE software suffered a high-severity unauthenticated remote denial-of-service vulnerability in UDP packet processing that was actively exploited in the wild. |
| 2021-11-03 | CVE-2020-3580 | critical | Cisco ASA/FTD devices were vulnerable to XSS, actively exploited and linked to ransomware attacks. |
SENTIMENT · TRUSTED SOURCES
synthesissevere-fallout-0.60
Cisco faced a significant vulnerability in its industrial protocol implementation, leading to potential denial-of-service attacks on critical infrastructure, though the response was not detailed in th
synthesissevere-fallout-0.60
The provided sources lack specific commentary on CVE-2022-20699's reception, focusing instead on unrelated 2026 Cisco vulnerabilities and generic threat intelligence. The severe nature of CVE-2022-206
synthesissevere-fallout-0.60
Cisco faced criticism for a DoS vulnerability in its SNMP subsystem affecting Catalyst switches, though the NVD entry itself is neutral; the broader industry context implies a negative reception due t
synthesisneutral+0.00
No sentiment data available for CVE-2017-6663 in provided sources; sources cover unrelated 2026 advisories and generic CVE databases.
synthesissevere-fallout-0.60
Cisco faced severe fallout for CVE-2017-6736, a critical SNMP remote code execution flaw in IOS and IOS XE that allowed authenticated attackers to execute arbitrary code remotely. The vulnerability wa
synthesissevere-fallout-0.60
CISA KEV listing and active exploitation indicate severe fallout, though source coverage is sparse and mostly generic.
synthesissevere-fallout-0.60
Cisco faced severe fallout for CVE-2017-6744, a critical SNMP remote code execution flaw in IOS that allowed authenticated attackers to execute code or reload systems. The vulnerability was widely rep
synthesissevere-fallout-0.60
Cisco faced severe fallout for CVE-2017-6738, a critical SNMP remote code execution flaw in IOS/IOS XE that allowed authenticated attackers to execute arbitrary code remotely. The vulnerability was di
synthesissevere-fallout-0.60
CVE-2022-20700 is a critical stack-based buffer overflow in Cisco Small Business routers allowing arbitrary code execution, privilege escalation, and DoS. The provided sources lack specific press comm
synthesissevere-fallout-0.60
Cisco's SNMP RCE vulnerability (CVE-2017-6739) represents a severe, long-standing flaw in a foundational network protocol implementation, allowing remote code execution and system reloads. The vendor'
synthesissevere-fallout-0.60
Cisco faced severe fallout for CVE-2017-6743, a critical SNMP remote code execution flaw in IOS and IOS XE that allowed authenticated attackers to execute arbitrary code remotely. The vulnerability wa
synthesissevere-fallout-0.60
Cisco faced severe fallout for CVE-2017-12232, a DoS vulnerability in ISR G2 routers allowing unauthenticated attackers to cause device reboots, widely criticized for the delay in patching and the sev
synthesissevere-fallout-0.60
Cisco faced criticism for a critical remote code execution flaw in its small business routers, though the NVD entry itself is neutral; the severity of the vulnerability implies a negative reception in
synthesissevere-fallout-0.60
CVE-2022-20708 represents a severe stack-based buffer overflow in Cisco Small Business routers allowing arbitrary code execution, privilege escalation, and DoS, indicating critical flaws in foundation
synthesisneutral+0.00
No sentiment expressed in provided sources.
synthesisneutral+0.00
No sentiment expressed in provided sources; only technical CVE data and unrelated content.
synthesissevere-fallout-0.60
Cisco faced severe fallout for CVE-2018-0151, a critical remote code execution vulnerability in its QoS subsystem that allowed unauthenticated attackers to execute arbitrary code or cause DoS. The NVD
synthesissevere-fallout-0.60
CVE-2017-12240 is a critical remote code execution flaw in Cisco's DHCP relay subsystem, allowing unauthenticated attackers full system control. The provided sources lack specific press coverage or au
synthesissevere-fallout-0.60
Cisco's BGP/EVPN DoS flaw (CVE-2017-12319) caused network instability and device reboots, reflecting poorly on their security posture despite being a known vulnerability.
synthesissevere-fallout-0.60
Vulnerability in core switching hardware caused DoS, but patch was released promptly.
synthesissevere-fallout-0.60
Cisco's NAT DoS flaw (CVE-2017-12231) is a remote, unauthenticated DoS vulnerability in IOS NAT, reflecting poor implementation and lack of timely mitigation, though no severe fallout or condemnation
synthesissevere-fallout-0.60
Cisco's Small Business router line suffered a critical stack-based buffer overflow allowing arbitrary code execution, privilege escalation, and DoS, exposing customers to severe risks with no praise f
synthesismixed-0.20
Vulnerability acknowledged and patched, but DoS impact is notable.
synthesisneutral+0.00
No sentiment data available in provided sources.
synthesissevere-fallout-0.60
Cisco's Small Business router line suffered a critical stack-based buffer overflow allowing arbitrary code execution, privilege escalation, and DoS, exposing customers to severe risks with no praise f
synthesissevere-fallout-0.60
Cisco's LLDP buffer overflow (CVE-2018-0167) allowed unauthenticated adjacent attackers to execute arbitrary code or cause DoS, representing a severe security failure in core networking infrastructure
synthesisneutral+0.00
No sentiment expressed; sources are vulnerability databases or unrelated content.
synthesissevere-fallout-0.60
CVE-2018-0158 was a critical DoS vulnerability in Cisco IOS/XE IKEv1, allowing unauthenticated remote attackers to crash devices. The NVD entry describes the technical severity but lacks commentary on
synthesismixed-0.20
Minimal press coverage for CVE-2018-0156; sources are databases or unrelated advisories, yielding no direct sentiment toward Cisco for this specific vulnerability.
synthesisneutral-0.20
No direct coverage of CVE-2017-12235 found in provided sources; sources are generic CVE databases or unrelated to this specific event.
FEDRAMP CATALOG PRODUCTS · 7
| PRODUCT | STATUS | IMPACT |
|---|---|---|
| Cisco Cloudlock for Government | Authorized | Moderate |
| Cisco Meraki for Government | In Process | Moderate |
| Cisco SD-WAN for Government | In Process | Moderate |
| Cisco Umbrella for Government | In Process | Moderate |
| Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) | Authorized | Moderate |
| WebEx Contact Center Enterprise for Government (WxCCE-G) | In Process | Moderate |
| Webex for Government | Authorized | Moderate |
DOSSIER SOURCES
- Cisco - Wikipedia · en.wikipedia.org
- Cisco Systems | History & Facts | Britannica Money · www.britannica.com
- CISCO SYSTEMS, INC. (CSCO, US17275R1023) - Company Profile · financialdata.net
- Vulnerability Reports - Latest network security threats and zeroday ... · talosintelligence.com
- Cisco SD-WAN Manager Hit by 7th Zero-Day of 2026, No Patch · dailysecurityreview.com
- Secure Access Change Log for 2026-06-26 to 2026-07-02 · community.cisco.com
Open questions: Cisco's remediation timeline for the 2026-06-25 and 2026-05-14 vulnerabilities · Impact of these vulnerabilities on active CMMC compliance programs
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-07-13 14:07:37.641701+00:00