Skip to content
Sign in

Cisco product

IOS

Alert
No CISA KEV deadline is open. CISA last added an IOS CVE on 13 Jul.

Tracked since 13 Jul · latest article 14 Jul · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 21 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date21

IOS CVEs in CISA KEV with their federal deadlines. None is open.

Exploited IOS CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2008-4128IOS13 JulPassed 16 Jul4
In CISA KEVCVE-2025-20352IOS and IOS XE29 SepPassed 20 Oct–
In CISA KEVCVE-2023-20109IOS and IOS XE10 OctPassed 31 Oct–
In CISA KEVCVE-2004-1464IOS19 MayPassed 9 Jun–
In CISA KEVCVE-2016-6415IOS, IOS XR, and IOS XE19 MayPassed 9 Jun–
In CISA KEVCVE-2017-6742IOS and IOS XE Software19 AprPassed 10 May–
Show 15 moreVendor CSV of 101 entries for CiscoAll 101 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds IOS CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’251Q3 ’250Q4 ’250Q1 ’260Q2 ’261Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20251
Q4 20250
Q1 20260
Q2 20260
Q3 20261
Q4 20260

Fix listed

1 of 2 CVEs in coverage

1 CVE has no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2018-0171: 99.9th percentile, in CISA KEVCVE-2008-4128: 98.4th percentile, in CISA KEV050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2018-017199.9
CVE-2008-412898.4

Coverage4 articles · all time

The latest 4 articles naming IOS, in the shared story grammar.

Full timeline
Quiet for 15 weekslast report 14 Jul4 articles3 outlets

4 articles from 3 outlets since 13 Jul. Quiet since 14 Jul.

Now13 Jul1415First reportCISA · 13 Jul, 17:57
  • Mon 13 Jul, 17:57 UTC. CISA, first report. CISA adds Cisco IOS CSRF flaw to KEV, cites active exploits. Cites a CVE in CISA KEV.
  • Mon 13 Jul, 18:21 UTC. CISA. CISA Adds Cisco IOS CVE-2008-4128 Flaw to KEV Catalog. Cites a CVE in CISA KEV.
  • Mon 13 Jul, 18:21 UTC. Security Affairs, its first report on the story. CISA Adds Cisco IOS CSRF Flaw CVE-2008-4128 to Exploit Catalog. Cites a CVE in CISA KEV.
  • Tue 14 Jul, 11:00 UTC. SecurityWeek, its first report on the story. Russian APT exploits Cisco router SNMP flaw to hit vital sectors. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 4 articles as a list
  1. Mon 13 JulDay 03
    1. CISA adds Cisco IOS CSRF flaw to KEV, cites active exploits17:57 · CISA · official · First report · CISA alert · Known exploited CVE
    2. CISA Adds Cisco IOS CVE-2008-4128 Flaw to KEV Catalog18:21 · CISA · official · Known exploited CVE
    3. CISA Adds Cisco IOS CSRF Flaw CVE-2008-4128 to Exploit Catalog18:21 · Security Affairs · Known exploited CVE
  2. Tue 14 JulDay 11
    1. Russian APT exploits Cisco router SNMP flaw to hit vital sectors11:00 · SecurityWeek · Known exploited CVE

All CVEs in coverage2

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2018-0171Exploited

    Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

    7.5High99.4% EPSS · 1 article
  • CVE-2008-4128Exploited

    Cisco IOS Cross-Site Request Forgery Vulnerability

    4.3Medium34% EPSS · 4 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in