Known vulnerabilities in Cisco IOS XE

Software: Cisco IOS XE
Software CPE: cpe:2.3:o:cisco_systems:cisco_ios_xe:*:*:*:*:*:*:*:*
Total vulnerabilities: 312
Public exploits: 7
Known exploited (KEV): 34
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Cisco IOS XE Cisco IOS XE is affected by 312 known vulnerabilities: 4 critical, 53 high, 121 medium, 134 low Critical High Medium Low

Vulnerabilities (312)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU141054 - Unchecked Input for Loop Condition
CVE-2026-20301
CWE-606 Medium
No
No
17.12.8, 17.15.6, 17.18.4 06.08.2026 SB2026080633
#VU141053 - Improper input validation
CVE-2026-20273
CWE-20 Medium
No
No
17.9.10, 17.12.8, 17.15.6, 17.18.4, 17.18.4a, 26.1.2 06.08.2026 SB2026080632
#VU141049 - Improper control of a resource through its lifetime
CVE-2026-20269
CWE-664 Medium
No
No
17.9.10, 17.12.8, 17.15.6, 17.18.4, 17.18.4a, 26.1.2 06.08.2026 SB2026080632
#VU141050 - Incorrect Calculation
CVE-2026-20270
CWE-682 Medium
No
No
17.9.10, 17.12.8, 17.15.6, 17.18.4, 17.18.4a, 26.1.2 06.08.2026 SB2026080632
#VU141051 - Insufficient Control Flow Management
CVE-2026-20271
CWE-691 Medium
No
No
17.9.10, 17.12.8, 17.15.6, 17.18.4, 17.18.4a, 26.1.2 06.08.2026 SB2026080632
#VU141052 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-20272
CWE-74 High
No
No
17.9.10, 17.12.8, 17.15.6, 17.18.4, 17.18.4a, 26.1.2 06.08.2026 SB2026080632
#VU141047 - Improper Access Control
CVE-2026-20267
CWE-284 Medium
No
No
17.9.10, 17.12.8, 17.15.6, 17.18.4, 17.18.4a, 26.1.2 06.08.2026 SB2026080632
#VU141048 - Memory corruption
CVE-2026-20268
CWE-119 Medium
No
No
17.9.10, 17.12.8, 17.15.6, 17.18.4, 17.18.4a, 26.1.2 06.08.2026 SB2026080632
#VU141046 - Buffer over-read
CVE-2026-20311
CWE-126 Low
No
No
17.12.8, 17.15.6, 17.18.4 06.08.2026 SB2026080631
#VU141045 - Error Handling
CVE-2026-20263
CWE-388 High
No
No
17.12.8, 17.15.6, 17.18.4 06.08.2026 SB2026080630
#VU141043 - Missing Release of Resource after Effective Lifetime
CVE-2026-20124
CWE-772 Low
No
No
17.9.10, 17.12.7, 17.15.5, 17.18.3, 26.1.1, 26.2.1ea, 26.02.01ea1 06.08.2026 SB2026080629
#VU141024 - Improper Privilege Management
CVE-2026-20308
CWE-269 Low
No
No
17.12.8, 17.15.6, 17.18.4 06.08.2026 SB2026080611
#VU124595 - Missing release of memory after effective lifetime
CVE-2026-20012
CWE-401 Medium
No
No
17.15.5 25.03.2026 SB20260325183
#VU124594 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2026-20113
CWE-93 Medium
No
No
17.15.5, 17.18.2 25.03.2026 SB20260325182
#VU124593 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-20112
CWE-79 Low
No
No
17.15.5, 17.18.2 25.03.2026 SB20260325182
#VU124590 - Incorrect Privilege Assignment
CVE-2026-20110
CWE-266 Low
No
No
17.15.5 25.03.2026 SB20260325180
#VU124589 - Cleartext Transmission of Sensitive Information
CVE-2026-20115
CWE-319 Medium
No
No
17.15.4s1 25.03.2026 SB20260325180
#VU124588 - Improper Validation of Syntactic Correctness of Input
CVE-2026-20114
CWE-1286 Medium
No
No
17.15.5, 17.18.1 25.03.2026 SB20260325180
#VU124587 - Improper Handling of Syntactically Invalid Structure
CVE-2026-20125
CWE-228 Medium
No
No
17.15.5 25.03.2026 SB20260325180
#VU124585 - Resource exhaustion
CVE-2026-20084
CWE-400 Medium
No
No
17.12.6 25.03.2026 SB20260325180


Showing elements 1 - 20 out of 312