Cisco
- Exploited flaws
- 102in 44 products
- Added to CISA's list in 2026
- 208 in 2025
- Used by ransomware
- 7of 102, says CISA
- Disclosure to CISA's list
- 1436 daysmedian; 31 of 89 listed within 30 days
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2004 | 1 |
| 2005 | 0 |
| 2006 | 0 |
| 2007 | 0 |
| 2008 | 1 |
| 2009 | 1 |
| 2010 | 1 |
| 2011 | 0 |
| 2012 | 0 |
| 2013 | 0 |
| 2014 | 1 |
| 2015 | 1 |
| 2016 | 3 |
| 2017 | 20 |
| 2018 | 18 |
| 2019 | 3 |
| 2020 | 9 |
| 2021 | 2 |
| 2022 | 7 |
| 2023 | 5 |
| 2024 | 5 |
| 2025 | 6 |
| 2026 | 18 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| IOS and IOS XE Software | 14 | 2022-03-03 | 2023-04-19 |
| Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | 6 | 2021-11-03 | 2024-10-24 |
| IOS XR | 6 | 2021-11-03 | 2022-05-23 |
| IOS software | 6 | 2022-03-03 | 2022-03-03 |
| Catalyst SD-WAN Manager | 5 | 2026-04-20 | 2026-09-30 |
| Small Business RV160, RV260, RV340, and RV345 Series Routers | 5 | 2022-03-03 | 2022-03-03 |
| Adaptive Security Appliance (ASA) | 4 | 2021-11-03 | 2024-11-12 |
| IOS Software | 4 | 2022-03-03 | 2022-03-03 |
| IOS and IOS XE | 4 | 2021-11-03 | 2025-09-29 |
| IOS Software and Cisco IOS XE Software | 3 | 2022-03-03 | 2022-03-03 |
| Identity Services Engine | 3 | 2025-07-28 | 2026-09-16 |
| AnyConnect Secure | 2 | 2022-10-24 | 2022-10-24 |
| HyperFlex HX | 2 | 2021-11-03 | 2021-11-03 |
| IOS | 2 | 2023-05-19 | 2026-07-13 |
| IOS XE Software | 2 | 2022-03-03 | 2022-03-03 |
And 5 more.
Latest on CISA's list
- Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
- Cisco Secure Email Gateway Relative Path Traversal Vulnerability
- Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
- Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
- Cisco Secure Email Gateway SQL Injection Vulnerability
- Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
- Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
- Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
- Cisco IOS Cross-Site Request Forgery Vulnerability
- Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
In the news
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.