Advisory hub
Cisco Security Advisories: ASA, NX-OS, IOS XE and Secure Firewall
13 advisories
Cisco edge devices — ASA and Secure Firewall (Firepower) appliances, IOS XE routers and NX-OS data-centre switches — sit on the perimeter and in the core of most enterprise networks, which is why exploited Cisco flaws so often appear in state-sponsored campaigns and in the CISA KEV catalog.
This hub lists the Cisco PSIRT advisories we have covered, with the affected software trains and the first fixed release from each advisory. Cisco publishes fixes per release train, so check the linked story for the exact train you run before scheduling an upgrade.
Advisories
| ID | Product & issue | Severity | KEV | Fix | Published |
|---|---|---|---|---|---|
| CVE-2026-76471 | Cisco NX-OS NX-API Overflow | Critical | No | Vendor advisory | |
| CVE-2026-76519 | Cisco Email Gateway File Write | Critical | Yes | Vendor advisory | |
| CVE-2026-76504 | Cisco SD-WAN Manager Auth Bypass | Critical | Yes | Vendor advisory | |
| CVE-2026-20329 | Cisco ASA/FTD Firewall RCE | Critical | No | Vendor advisory | |
| CVE-2026-20262 | Cisco SD-WAN Manager Traversal | Critical | Yes | Vendor advisory | |
| CVE-2008-4128 | Cisco IOS HTTP Server CSRF | High | Yes | Vendor advisory | |
| CVE-2026-20230 | Cisco Unified CM SSRF | High | Yes | Vendor advisory | |
| CVE-2026-76460 | Cisco ISE API Auth Bypass | Critical | Yes | Vendor advisory | |
| CVE-2026-20349 | Cisco ASA/FTD Heap Corruption | Critical | Yes | Vendor advisory | |
| CVE-2026-76461 | Cisco Secure Email SQLi | Critical | Yes | Vendor advisory | |
| CVE-2026-20274 | Cisco IOS XR BGP RCE | High | No | Vendor advisory | |
| — | Twelve Zero-Days Weaponized in One Week Across Citrix, Cisco and Fortinet | Critical | Yes | Vendor advisory | |
| CVE-2026-20212 | Cisco Nexus 9000 Root RCE | Critical | No | Vendor advisory |
KEV: listed in CISA's Known Exploited Vulnerabilities catalog. “No” means not listed when we published, not that the flaw is safe to defer.
You're on the list.
We'll email you when the next issue goes out.
Free newsletter
The Daily Brief
The exploited vulnerabilities, patch priorities and regulatory changes worth acting on, in one short email.
- Exploited CVEs, with affected products and patch status
- Patch priorities ranked by real-world exploitation
- Regulatory changes: CERT-In, RBI, DPDP, DORA, NIS2
Free