Security feed

24 October 2026

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device. CISA required action: Apply updates per vendor instructions.

IOS and IOS XE CVE-2018-0171

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2018-0171

IOS and IOS XE

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2018-0171
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3527 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:36:28 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Cisco IOS and IOS XE Remote Code Execution Vulnerability

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. CISA required action: Apply updates per vendor instructions.

IOS and IOS XE CVE-2017-3881

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-3881

IOS and IOS XE

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-3881
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2720 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:23:32 GMT
Publisher date: Fri, 25 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability

Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

IOS and IOS XE CVE-2023-20109

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2023-20109

IOS and IOS XE

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2023-20109
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1238 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:58:44 GMT
Publisher date: Tue, 10 Oct 2023 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

IOS and IOS XE CVE-2025-20352

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2025-20352

IOS and IOS XE

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2025-20352
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #339 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:44:24 GMT
Publisher date: Mon, 29 Sep 2025 00:00:00 GMT

Read the original announcement