Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Report Cards
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0

Platform

My Vulnerabilities
Insights
Notifications
Account
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Book a demo

Get Started

Sign up
Log in

Legal

Privacy
Terms

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in

Home
Vendors
Cisco
Cisco Ios Software

Cisco IOS Software Vulnerabilities: CVEs, CISA KEV & Security Advisories

28 CVEs

12 in CISA KEV

Cisco IOS Software Vulnerabilities

CVE security advisories and vulnerability history for Cisco IOS Software by cisco.

28

Total CVEs

Published

12

In CISA KEV

Exploited in the wild

12

Public exploits

With known exploit

8.1

Avg CVSS

2017–2025

Last updated September 25, 2025

Overview

Cisco IOS Software has 28 published CVE records since 2017, of which 12 are in CISA's Known Exploited Vulnerabilities catalog and 12 have a known public exploit. The average CVSS base score across scored CVEs is 8.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Cisco IOS Software, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Cisco IOS Software's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical4

High10

Medium4

Low0

10 additional CVEs have no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

12

12 of Cisco IOS Software's CVEs are confirmed exploited in the wild.

Public exploits

12

12 of Cisco IOS Software's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Cisco IOS Software version named in a CVE, then pick one to see only the CVEs that affect it.

No specific affected versions are recorded for Cisco IOS Software; the CVEs below apply to the product without a version pin.

28 CVEs

Sort

Critical vulnerability · 2025-09-25
CVE-2025-20363
Patch
CWE-122
Critical · CVSS 9.0
EPSS 6.4% (91th pct)2025-09-25
Medium vulnerability · 2025-09-24
CVE-2025-20149CWE-120
Medium · CVSS 6.5
EPSS 0.0% (10th pct)2025-09-24
High vulnerability · 2025-09-24
CVE-2025-20352
CISA KEV
Public exploit
CWE-121
Added to CISA KEV 2025-09-29
High · CVSS 8.7
EPSS 4.0% (89th pct)2025-09-24
Cisco IOS, IOS XE, Secure Firewall Adaptive Security Appliance, and Secure Firewall Threat Defense Software IKEv2 Denial of Service Vulnerability
CVE-2025-20253CWE-835
High · CVSS 8.6
EPSS 0.1% (20th pct)2025-08-14
High vulnerability · 2025-08-14
CVE-2025-20239CWE-401
High · CVSS 8.6
EPSS 0.2% (36th pct)2025-08-14
High vulnerability · 2023-09-27
CVE-2023-20109
CISA KEV
Public exploit
CWE-787
Added to CISA KEV 2023-10-10
High · CVSS 7.5
EPSS 0.6% (71th pct)2023-09-27
Cisco IOS Software Catalyst 6500 Series 802.1x Authentication Bypass Vulnerability
CVE-2019-1758CWE-287
Medium · CVSS 4.7
EPSS 0.2% (45th pct)2019-03-28
High vulnerability · 2019-03-28
CVE-2019-1751CWE-20
High · CVSS 8.6
EPSS 0.9% (77th pct)2019-03-28
Vulnerability · 2018-10-05
CVE-2018-15377CWE-400
Unscored
EPSS 0.6% (69th pct)2018-10-05
Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Arbitrary Memory Write Vulnerabilities
CVE-2018-15376CWE-123
Unscored
EPSS 0.1% (20th pct)2018-10-05
Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Arbitrary Memory Write Vulnerabilities
CVE-2018-15375CWE-123
Unscored
EPSS 0.1% (20th pct)2018-10-05
Vulnerability · 2018-10-05
CVE-2018-15373CWE-399
Unscored
EPSS 0.3% (49th pct)2018-10-05
Vulnerability · 2018-10-05
CVE-2018-15369CWE-20
Unscored
EPSS 0.2% (40th pct)2018-10-05
Vulnerability · 2018-10-05
CVE-2018-0485CWE-19
Unscored
EPSS 3.8% (88th pct)2018-10-05
Vulnerability · 2018-10-05
CVE-2018-0475CWE-20
Unscored
EPSS 0.3% (49th pct)2018-10-05
Vulnerability · 2018-10-05
CVE-2018-0473CWE-399
Unscored
EPSS 1.5% (81th pct)2018-10-05
Cisco IOS and IOS XE Software IPv6 Hop-by-Hop Options Denial of Service Vulnerability
CVE-2018-0467CWE-20
Unscored
EPSS 1.5% (81th pct)2018-10-05
Vulnerability · 2018-10-05
CVE-2018-0466CWE-399
Unscored
EPSS 0.3% (57th pct)2018-10-05
Medium vulnerability · 2018-03-28
CVE-2018-0180
CISA KEV
Public exploit
CWE-399
Added to CISA KEV 2022-03-03
Medium · CVSS 6.8
EPSS 1.7% (83th pct)2018-03-28
Critical vulnerability · 2018-03-28
CVE-2018-0179
CISA KEV
Public exploit
CWE-399
Added to CISA KEV 2022-03-03
Critical · CVSS 9.2
EPSS 2.0% (84th pct)2018-03-28
Critical vulnerability · 2018-03-28
CVE-2018-0173
CISA KEV
Public exploit
CWE-20
Added to CISA KEV 2022-03-03
Critical · CVSS 9.2
EPSS 5.4% (90th pct)2018-03-28
High vulnerability · 2018-03-28
CVE-2018-0167
CISA KEV
Public exploit
Patch
CWE-119
Added to CISA KEV 2022-03-03
High · CVSS 8.7
EPSS 1.2% (79th pct)2018-03-28
Medium vulnerability · 2018-03-28
CVE-2018-0161
CISA KEV
Public exploit
CWE-399
Added to CISA KEV 2022-03-03
Medium · CVSS 6.3
EPSS 0.9% (76th pct)2018-03-28
High vulnerability · 2018-03-28
CVE-2018-0159
CISA KEV
Public exploit
CWE-20
Added to CISA KEV 2022-03-03
High · CVSS 8.7
EPSS 7.0% (92th pct)2018-03-28
High vulnerability · 2018-03-28
CVE-2018-0158
CISA KEV
Public exploit
CWE-20
Added to CISA KEV 2022-03-03
High · CVSS 8.7
EPSS 14.6% (95th pct)2018-03-28
Critical vulnerability · 2018-03-28
CVE-2018-0151
CISA KEV
Public exploit
CWE-119
Added to CISA KEV 2022-03-03
Critical · CVSS 9.3
EPSS 5.9% (91th pct)2018-03-28
High vulnerability · 2017-08-07
CVE-2017-6663
CISA KEV
Public exploit
Added to CISA KEV 2022-03-03
High · CVSS 7.1
EPSS 2.6% (86th pct)2017-08-07
High vulnerability · 2017-07-17
CVE-2017-6738
CISA KEV
Public exploit
CWE-119
Added to CISA KEV 2022-03-03
High · CVSS 8.7
EPSS 20.4% (96th pct)2017-07-17

Common weakness types

The CWE weakness categories most often found in Cisco IOS Software CVEs. Follow any weakness for its full explanation.

CWE-20Improper Input Validation7 CVEs
CWE-3996 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer3 CVEs
CWE-123Write-what-where Condition2 CVEs
CWE-191 CVE
CWE-121Stack-based Buffer Overflow1 CVE
CWE-287Improper Authentication1 CVE
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')1 CVE

Disclosure activity by year

How many Cisco IOS Software CVEs were published each year.

2017

2

2018

18

2019

2

2023

1

2025

5

Other cisco products

Browse vulnerabilities for other products by cisco.

ios625 CVEs ios xe542 CVEs adaptive security appliance software349 CVEs nx-os278 CVEs Cisco Small Business RV Series Router Firmware262 CVEs Cisco IOS XE Software246 CVEs unified communications manager238 CVEs firepower threat defense230 CVEs

All cisco vulnerabilities

Frequently asked questions

Common questions about Cisco IOS Software vulnerabilities.

How many CVEs does cisco Cisco IOS Software have?

cisco Cisco IOS Software has 28 published CVE records since 2017.

How many cisco Cisco IOS Software CVEs are in CISA KEV?

Yes — 12 of cisco Cisco IOS Software's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for cisco Cisco IOS Software vulnerabilities?

Yes — 12 of cisco Cisco IOS Software's CVEs have a known public exploit.

What are the most common weakness types in cisco Cisco IOS Software CVEs?

cisco Cisco IOS Software's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-399, CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-123 (Write-what-where Condition).

How many critical cisco Cisco IOS Software vulnerabilities are there?

cisco Cisco IOS Software has 4 critical and 10 high-severity CVEs.

What is the average severity of cisco Cisco IOS Software CVEs?

The average CVSS base score across cisco Cisco IOS Software's scored CVEs is 8.1.

References

All cisco vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Cisco IOS Software vulnerabilities

Monitor new Cisco IOS Software vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References