# IOS vulnerabilities

> IOS is made by Cisco. We track 598 published vulnerabilities listed under that exact name, across 8,443 versions. 38 of them are on the list of flaws known to be exploited, the newest added on 13 July 2026. Cisco lists newer releases under their own names, such as IOS XE, so check those pages too.

Canonical page: https://www.precursorintelligence.com/product/cisco/ios

## At a glance

- **Made by:** [Cisco](https://www.precursorintelligence.com/vendors/cisco)
- **Published vulnerabilities:** 598
- **Known to be exploited:** 38 (listed under the name IOS)
- **Versions tracked:** 8,443
- **Most recently added to the known-exploited list:** [CVE-2008-4128](https://www.precursorintelligence.com/what-is/cve-2008-4128), 13 July 2026. We keep watching the list.

## Is IOS listed under other names?

Cisco also lists IOS under more specific names, such as IOS XE and IOS XR. Flaws listed only under those names are counted on their own pages, not here.

- [IOS XE](https://www.precursorintelligence.com/product/cisco/ios_xe): 506 published vulnerabilities
- [IOS XR](https://www.precursorintelligence.com/product/cisco/ios_xr): 188 published vulnerabilities
- [Ios XE SD-WAN](https://www.precursorintelligence.com/product/cisco/ios_xe_sd-wan): 26 published vulnerabilities
- [Ios Xrv 9000](https://www.precursorintelligence.com/product/cisco/ios_xrv_9000): 13 published vulnerabilities
- [Ios Xrv](https://www.precursorintelligence.com/product/cisco/ios_xrv): 6 published vulnerabilities
- [Ios Transmission Control Protocol](https://www.precursorintelligence.com/product/cisco/ios_transmission_control_protocol): 4 published vulnerabilities
- [Ios XE Rom Monitor](https://www.precursorintelligence.com/product/cisco/ios_xe_rom_monitor): 3 published vulnerabilities
- [Ios XE 3.3xo](https://www.precursorintelligence.com/product/cisco/ios_xe_3.3xo): 3 published vulnerabilities
- [Ios XE 3.3sg](https://www.precursorintelligence.com/product/cisco/ios_xe_3.3sg): 3 published vulnerabilities
- [Ios XE 3.4sg](https://www.precursorintelligence.com/product/cisco/ios_xe_3.4sg): 3 published vulnerabilities
- [Ios XE 16.1](https://www.precursorintelligence.com/product/cisco/ios_xe_16.1): 2 published vulnerabilities
- [Ios XE 3.2ja](https://www.precursorintelligence.com/product/cisco/ios_xe_3.2ja): 2 published vulnerabilities

## Which versions of IOS do the exploited flaws hit?

Each exploited flaw lists the versions it affects, as published.

- [CVE-2008-4128](https://www.precursorintelligence.com/what-is/cve-2008-4128) (Cisco IOS Cross-Site Request Forgery Vulnerability): 12.4
- [CVE-2023-20109](https://www.precursorintelligence.com/what-is/cve-2023-20109) (Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability): 12.4(22)md, 12.4(22)md1, 12.4(22)md2, 12.4(22)mda, 12.4(22)mda1, 12.4(22)mda2, 12.4(22)mda3, 12.4(22)mda4, 12.4(22)mda5, 12.4(22)mda6, 12.4(22)t, 12.4(22)t1, 12.4(22)t2, 12.4(22)t3, 12.4(22)t4, 12.4(22)t5, 12.4(22)xr1, 12.4(22)xr2, 12.4(22)xr3, 12.4(22)xr4, 12.4(22)xr5, 12.4(22)xr6, 12.4(22)xr7, 12.4(22)xr8, 12.4(22)xr9, 12.4(22)xr10, 12.4(22)xr11, 12.4(22)xr12, 12.4(24)md, 12.4(24)md1, 12.4(24)md2, 12.4(24)md3, 12.4(24)md4, 12.4(24)md5, 12.4(24)md6, 12.4(24)md7, 12.4(24)mda1, 12.4(24)mda2, 12.4(24)mda3, 12.4(24)mda4, 12.4(24)mda5, 12.4(24)mda6, 12.4(24)mda7, 12.4(24)mda8, 12.4(24)mda9, 12.4(24)mda10, 12.4(24)mda11, 12.4(24)mda12, 12.4(24)mda13, 12.4(24)mdb, 12.4(24)mdb1, 12.4(24)mdb3, 12.4(24)mdb4, 12.4(24)mdb5a, 12.4(24)mdb5, 12.4(24)mdb6, 12.4(24)mdb7, 12.4(24)mdb8, 12.4(24)mdb9, 12.4(24)mdb10, 12.4(24)mdb11, 12.4(24)mdb12, 12.4(24)mdb13, 12.4(24)mdb14, 12.4(24)mdb15, 12.4(24)mdb16, 12.4(24)mdb17, 12.4(24)mdb18, 12.4(24)mdb19, 12.4(24)t, 12.4(24)t1, 12.4(24)t2, 12.4(24)t3, 12.4(24)t3e, 12.4(24)t3f, 12.4(24)t4a, 12.4(24)t4b, 12.4(24)t4, 12.4(24)t4c, 12.4(24)t4d, 12.4(24)t4e, 12.4(24)t4f, 12.4(24)t4l, 12.4(24)t5, 12.4(24)t6, 12.4(24)t7, 12.4(24)t8, 12.4(24)yg, 12.4(24)yg1, 12.4(24)yg2, 12.4(24)yg3, 12.4(24)yg4, 15.0(1)m, 15.0(1)m1, 15.0(1)m2, 15.0(1)m3, 15.0(1)m4, 15.0(1)m5, 15.0(1)m6, 15.0(1)m7, 15.0(1)m8, 15.0(1)m9, 15.0(1)m10, 15.0(1)mr, 15.0(1)s, 15.0(1)s1, 15.0(1)s2, 15.0(1)s3a, 15.0(1)s4a, 15.0(1)s4, 15.0(1)s5, 15.0(1)s6, 15.0(1)xa, 15.0(1)xa1, 15.0(1)xa2, 15.0(1)xa3, 15.0(1)xa4, 15.0(1)xa5, 15.0(2a)ex5, 15.0(2)ea, 15.0(2)ea1, 15.0(2)ej, 15.0(2)ej1, 15.0(2)ek, 15.0(2)ek1, 15.0(2)ex, 15.0(2)ex1, 15.0(2)ex2, 15.0(2)ex3, 15.0(2)ex4, 15.0(2)ex5, 15.0(2)ex8, 15.0(2)ex10, 15.0(2)ex11, 15.0(2)ex12, 15.0(2)ex13, 15.0(2)ey, 15.0(2)ey1, 15.0(2)ey2, 15.0(2)ey3, 15.0(2)ez, 15.0(2)mr, 15.0(2)se, 15.0(2)se1, 15.0(2)se2, 15.0(2)se3, 15.0(2)se4, 15.0(2)se5, 15.0(2)se6, 15.0(2)se7, 15.0(2)se8, 15.0(2)se9, 15.0(2)se10a, 15.0(2)se10, 15.0(2)se11, 15.0(2)se12, 15.0(2)se13, 15.1(1)s, 15.1(1)s1, 15.1(1)s2, 15.1(1)sg, 15.1(1)sg1, 15.1(1)sg2, 15.1(1)sy, 15.1(1)sy1, 15.1(1)sy2, 15.1(1)sy3, 15.1(1)sy4, 15.1(1)sy5, 15.1(1)sy6, 15.1(1)t, 15.1(1)t1, 15.1(1)t2, 15.1(1)t3, 15.1(1)t4, 15.1(1)t5, 15.1(1)xb, 15.1(2)gc, 15.1(2)gc1, 15.1(2)gc2, 15.1(2)s, 15.1(2)s1, 15.1(2)s2, 15.1(2)sg, 15.1(2)sg1, 15.1(2)sg2, 15.1(2)sg3, 15.1(2)sg4, 15.1(2)sg5, 15.1(2)sg6, 15.1(2)sg7, 15.1(2)sg8, 15.1(2)sy, 15.1(2)sy1, 15.1(2)sy2, 15.1(2)sy3, 15.1(2)sy4a, 15.1(2)sy4, 15.1(2)sy5, 15.1(2)sy6, 15.1(2)sy7, 15.1(2)sy8, 15.1(2)sy9, 15.1(2)sy10, 15.1(2)sy11, 15.1(2)sy12, 15.1(2)sy13, 15.1(2)sy14, 15.1(2)sy15, 15.1(2)sy16, 15.1(2)t, 15.1(2)t0a, 15.1(2)t1, 15.1(2)t2a, 15.1(2)t2, 15.1(2)t3, 15.1(2)t4, 15.1(2)t5, 15.1(3)mra, 15.1(3)mra1, 15.1(3)mra2, 15.1(3)mra3, 15.1(3)mra4, 15.1(3)s, 15.1(3)s0a, 15.1(3)s1, 15.1(3)s2, 15.1(3)s3, 15.1(3)s4, 15.1(3)s5a, 15.1(3)s5, 15.1(3)s6, 15.1(3)svb1, 15.1(3)svb2, 15.1(3)svd, 15.1(3)svd1, 15.1(3)svd2, 15.1(3)sve, 15.1(3)svf, 15.1(3)svf1, 15.1(3)svg, 15.1(3)svj2, 15.1(3)t, 15.1(3)t1, 15.1(3)t2, 15.1(3)t3, 15.1(3)t4, 15.1(4)gc, 15.1(4)gc1, 15.1(4)gc2, 15.1(4)m, 15.1(4)m1, 15.1(4)m2, 15.1(4)m3a, 15.1(4)m3, 15.1(4)m4, 15.1(4)m5, 15.1(4)m6, 15.1(4)m7, 15.1(4)m8, 15.1(4)m9, 15.1(4)m10, 15.2(1)e, 15.2(1)e1, 15.2(1)e2, 15.2(1)e3, 15.2(1)ey, 15.2(1)gc, 15.2(1)gc1, 15.2(1)gc2, 15.2(1)s, 15.2(1)s1, 15.2(1)s2, 15.2(1)sy, 15.2(1)sy0a, 15.2(1)sy1a, 15.2(1)sy1, 15.2(1)sy2, 15.2(1)sy3, 15.2(1)sy4, 15.2(1)sy5, 15.2(1)sy6, 15.2(1)sy7, 15.2(1)sy8, 15.2(2a)e1, 15.2(2a)e2, 15.2(2)e, 15.2(2)e1, 15.2(2)e2, 15.2(2)e3, 15.2(2)e4, 15.2(2)e5a, 15.2(2)e5b, 15.2(2)e5, 15.2(2)e6, 15.2(2)e7b, 15.2(2)e7, 15.2(2)e8, 15.2(2)e9, 15.2(2)e10, 15.2(2)ea, 15.2(2)ea1, 15.2(2)ea2, 15.2(2)ea3, 15.2(2)eb, 15.2(2)eb1, 15.2(2)eb2, 15.2(2)gc, 15.2(2)s, 15.2(2)s0a, 15.2(2)s0c, 15.2(2)s1, 15.2(2)s2, 15.2(2)sy, 15.2(2)sy1, 15.2(2)sy2, 15.2(2)sy3, 15.2(3a)e, 15.2(3)e, 15.2(3)e1, 15.2(3)e2, 15.2(3)e3, 15.2(3)e4, 15.2(3)e5, 15.2(3)ea, 15.2(3)gc, 15.2(3)gc1, 15.2(4)e, 15.2(4)e1, 15.2(4)e2, 15.2(4)e3, 15.2(4)e4, 15.2(4)e5a, 15.2(4)e5, 15.2(4)e6, 15.2(4)e7, 15.2(4)e8, 15.2(4)e9, 15.2(4)e10a, 15.2(4)e10, 15.2(4)e10d, 15.2(4)ea, 15.2(4)ea1, 15.2(4)ea3, 15.2(4)ea4, 15.2(4)ea5, 15.2(4)ea6, 15.2(4)ea7, 15.2(4)ea8, 15.2(4)ea9a, 15.2(4)ea9, 15.2(4)ec1, 15.2(4)ec2, 15.2(4)gc, 15.2(4)gc1, 15.2(4)gc2, 15.2(4)gc3, 15.2(4)m, 15.2(4)m1, 15.2(4)m2, 15.2(4)m3, 15.2(4)m4, 15.2(4)m5, 15.2(4)m6a, 15.2(4)m6, 15.2(4)m7, 15.2(4)m8, 15.2(4)m9, 15.2(4)m10, 15.2(4)m11, 15.2(4)s, 15.2(4)s1, 15.2(4)s2, 15.2(4)s3a, 15.2(4)s3, 15.2(4)s4a, 15.2(4)s4, 15.2(4)s5, 15.2(4)s6, 15.2(4)s7, 15.2(5a)e, 15.2(5a)e1, 15.2(5b)e, 15.2(5c)e, 15.2(5)e, 15.2(5)e1, 15.2(5)e2b, 15.2(5)e2, 15.2(5)e2c, 15.2(5)ea, 15.2(5)ex, 15.2(6)e, 15.2(6)e0a, 15.2(6)e0c, 15.2(6)e1, 15.2(6)e2a, 15.2(6)e2b, 15.2(6)e2, 15.2(6)e3, 15.2(6)eb, 15.2(7a)e0b, 15.2(7b)e0b, 15.2(7)e, 15.2(7)e0a, 15.2(7)e0b, 15.2(7)e0s, 15.2(7)e1a, 15.2(7)e1, 15.2(7)e2a, 15.2(7)e2, 15.2(7)e3, 15.2(7)e3k, 15.2(7)e4, 15.2(7)e5, 15.2(7)e6, 15.2(7)e7, 15.2(7)e8, 15.2(8)e, 15.2(8)e1, 15.2(8)e2, 15.2(8)e3, 15.2(8)e4, 15.3(1)s, 15.3(1)s1, 15.3(1)s2, 15.3(1)sy, 15.3(1)sy1, 15.3(1)sy2, 15.3(1)t, 15.3(1)t1, 15.3(1)t2, 15.3(1)t3, 15.3(1)t4, 15.3(2)s, 15.3(2)s1, 15.3(2)s2, 15.3(2)t, 15.3(2)t1, 15.3(2)t2, 15.3(2)t3, 15.3(2)t4, 15.3(3)m, 15.3(3)m1, 15.3(3)m2, 15.3(3)m3, 15.3(3)m4, 15.3(3)m5, 15.3(3)m6, 15.3(3)m7, 15.3(3)m8a, 15.3(3)m8, 15.3(3)m9, 15.3(3)m10, 15.3(3)s, 15.3(3)s1a, 15.3(3)s1, 15.3(3)s2, 15.3(3)s3, 15.3(3)s4, 15.3(3)s5, 15.3(3)s6, 15.3(3)s7, 15.3(3)s8a, 15.3(3)s8, 15.3(3)s9, 15.3(3)s10, 15.4(1)cg, 15.4(1)cg1, 15.4(1)s, 15.4(1)s1, 15.4(1)s2, 15.4(1)s3, 15.4(1)s4, 15.4(1)sy, 15.4(1)sy1, 15.4(1)sy2, 15.4(1)sy3, 15.4(1)sy4, 15.4(1)t, 15.4(1)t1, 15.4(1)t2, 15.4(1)t3, 15.4(1)t4, 15.4(2)cg, 15.4(2)s, 15.4(2)s1, 15.4(2)s2, 15.4(2)s3, 15.4(2)s4, 15.4(2)t, 15.4(2)t1, 15.4(2)t2, 15.4(2)t3, 15.4(2)t4, 15.4(3)m, 15.4(3)m1, 15.4(3)m2, 15.4(3)m3, 15.4(3)m4, 15.4(3)m5, 15.4(3)m6a, 15.4(3)m6, 15.4(3)m7, 15.4(3)m8, 15.4(3)m9, 15.4(3)m10, 15.4(3)s, 15.4(3)s1, 15.4(3)s2, 15.4(3)s3, 15.4(3)s4, 15.4(3)s5, 15.4(3)s6a, 15.4(3)s6, 15.4(3)s7, 15.4(3)s8, 15.4(3)s9, 15.4(3)s10, 15.5(1)s, 15.5(1)s1, 15.5(1)s2, 15.5(1)s3, 15.5(1)s4, 15.5(1)sy, 15.5(1)sy1, 15.5(1)sy2, 15.5(1)sy3, 15.5(1)sy4, 15.5(1)sy5, 15.5(1)sy6, 15.5(1)sy7, 15.5(1)sy8, 15.5(1)sy9, 15.5(1)sy10, 15.5(1)sy11, 15.5(1)t, 15.5(1)t1, 15.5(1)t2, 15.5(1)t3, 15.5(1)t4, 15.5(2)s, 15.5(2)s1, 15.5(2)s2, 15.5(2)s3, 15.5(2)s4, 15.5(2)t, 15.5(2)t1, 15.5(2)t2, 15.5(2)t3, 15.5(2)t4, 15.5(3)m, 15.5(3)m0a, 15.5(3)m1, 15.5(3)m2, 15.5(3)m3, 15.5(3)m4a, 15.5(3)m4, 15.5(3)m5, 15.5(3)m6a, 15.5(3)m6, 15.5(3)m7, 15.5(3)m8, 15.5(3)m9, 15.5(3)m10, 15.5(3)s, 15.5(3)s0a, 15.5(3)s1a, 15.5(3)s1, 15.5(3)s2, 15.5(3)s3, 15.5(3)s4, 15.5(3)s5, 15.5(3)s6a, 15.5(3)s6b, 15.5(3)s6, 15.5(3)s7, 15.5(3)s8, 15.5(3)s9a, 15.5(3)s9, 15.5(3)s10, 15.5(3)sn, 15.6(1)s, 15.6(1)s1, 15.6(1)s2, 15.6(1)s3, 15.6(1)s4, 15.6(1)t, 15.6(1)t0a, 15.6(1)t1, 15.6(1)t2, 15.6(1)t3, 15.6(2)s, 15.6(2)s1, 15.6(2)s2, 15.6(2)s3, 15.6(2)s4, 15.6(2)sn, 15.6(2)sp, 15.6(2)sp1, 15.6(2)sp2, 15.6(2)sp3, 15.6(2)sp4, 15.6(2)sp5, 15.6(2)sp6, 15.6(2)sp7, 15.6(2)sp8, 15.6(2)sp9, 15.6(2)sp10, 15.6(2)t, 15.6(2)t1, 15.6(2)t2, 15.6(2)t3, 15.6(3)m, 15.6(3)m0a, 15.6(3)m1b, 15.6(3)m1, 15.6(3)m2a, 15.6(3)m2, 15.6(3)m3a, 15.6(3)m3, 15.6(3)m4, 15.6(3)m5, 15.6(3)m6a, 15.6(3)m6b, 15.6(3)m6, 15.6(3)m7, 15.6(3)m8, 15.6(3)m9, 15.7(3)m, 15.7(3)m0a, 15.7(3)m1, 15.7(3)m2, 15.7(3)m3, 15.7(3)m4a, 15.7(3)m4b, 15.7(3)m4, 15.7(3)m5, 15.7(3)m6, 15.7(3)m7, 15.7(3)m8, 15.7(3)m9, 15.8(3)m, 15.8(3)m0a, 15.8(3)m0b, 15.8(3)m1a, 15.8(3)m1, 15.8(3)m2a, 15.8(3)m2, 15.8(3)m3a, 15.8(3)m3b, 15.8(3)m3, 15.8(3)m4, 15.8(3)m5, 15.8(3)m6, 15.8(3)m7, 15.8(3)m8, 15.8(3)m9, 15.8(3)m10, 15.9(3)m, 15.9(3)m0a, 15.9(3)m1, 15.9(3)m2a, 15.9(3)m2, 15.9(3)m3a, 15.9(3)m3b, 15.9(3)m3, 15.9(3)m4a, 15.9(3)m4, 15.9(3)m5, 15.9(3)m6a, 15.9(3)m6b, 15.9(3)m6, 15.9(3)m7a, 15.9(3)m7
- [CVE-2004-1464](https://www.precursorintelligence.com/what-is/cve-2004-1464) (Cisco IOS Denial-of-Service Vulnerability): up to 12.2(15)zj3
- [CVE-2016-6415](https://www.precursorintelligence.com/what-is/cve-2016-6415) (Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability): 12.2 to 12.4, 15.0 to 15.6
- [CVE-2017-6742](https://www.precursorintelligence.com/what-is/cve-2017-6742) (Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability): 12.0 to 12.4, 15.0 to 15.6
- [CVE-2017-3881](https://www.precursorintelligence.com/what-is/cve-2017-3881) (Cisco IOS and IOS XE Remote Code Execution Vulnerability): 12.2s to 15.1(3)svs
- [CVE-2017-12234](https://www.precursorintelligence.com/what-is/cve-2017-12234) (Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability): 12.4 to 15.6
- [CVE-2017-12235](https://www.precursorintelligence.com/what-is/cve-2017-12235) (Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability): 12.2 to 15.6
- [CVE-2017-12237](https://www.precursorintelligence.com/what-is/cve-2017-12237) (Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability): 15.0 to 15.6
- [CVE-2017-12238](https://www.precursorintelligence.com/what-is/cve-2017-12238) (Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability): 15.0 to 15.4
- [CVE-2017-12240](https://www.precursorintelligence.com/what-is/cve-2017-12240) (Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability): 12.2 to 15.6
- [CVE-2017-12319](https://www.precursorintelligence.com/what-is/cve-2017-12319) (Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability): 15.4(1)s
- [CVE-2017-6627](https://www.precursorintelligence.com/what-is/cve-2017-6627) (Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability): 15.1(2)gc, 15.1(2)gc1, 15.1(2)gc2, 15.1(4)gc, 15.1(4)gc1, 15.1(4)gc2, 15.2(1)gc, 15.2(1)gc1, 15.2(1)gc2, 15.2(2)gc, 15.2(3r)gca, 15.2(3)gc, 15.2(3)gc1, 15.2(4)gc, 15.2(4)gc1, 15.2(4)gc2, 15.2(4)gc3, 15.4(1)t, 15.4(1)t1, 15.4(1)t2, 15.4(1)t3, 15.4(1)t4, 15.4(2)t, 15.4(2)t1, 15.4(2)t2, 15.4(3)m, 15.4(3)m1, 15.4(3)m2, 15.4(3)m2.2, 15.4(3)m3, 15.4(3)m4, 15.4(3)m5, 15.4(3)m6a, 15.4(3)m6, 15.4(3)m7
- [CVE-2017-6663](https://www.precursorintelligence.com/what-is/cve-2017-6663) (Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability): 15.2(3a)e, 15.2(3a)e1, 15.2(3m)e2, 15.2(3m)e3, 15.2(3m)e6, 15.2(3m)e8, 15.2(3)e, 15.2(3)e1, 15.2(3)e2, 15.2(3)e3, 15.2(3)e4, 15.2(3)e5, 15.2(4)e, 15.2(4)e1, 15.2(4)e2, 15.2(4)e3, 15.2(5a)e, 15.2(5b)e, 15.2(5)e, 15.2(5)e1, 15.3(3)s, 15.3(3)s1a, 15.3(3)s1, 15.3(3)s2, 15.3(3)s3, 15.3(3)s4, 15.3(3)s5, 15.3(3)s6, 15.3(3)s7, 15.3(3)s8a, 15.3(3)s8, 15.3(3)s9, 15.3(3)s10, 15.4(1)s, 15.4(1)s1, 15.4(1)s2, 15.4(1)s3, 15.4(1)s4, 15.4(2)s, 15.4(2)s1, 15.4(2)s2, 15.4(2)s3, 15.4(2)s4, 15.4(3)s, 15.4(3)s1, 15.4(3)s2, 15.4(3)s3, 15.4(3)s4, 15.4(3)s5a, 15.4(3)s5, 15.4(3)s6a, 15.4(3)s6b, 15.4(3)s6, 15.4(3)s7a, 15.4(3)s7, 15.4(3)s8, 15.5(1)s, 15.5(1)s1, 15.5(1)s2, 15.5(1)s3, 15.5(1)s4, 15.5(2)s, 15.5(2)s1, 15.5(2)s2, 15.5(2)s3, 15.5(2)s4, 15.5(3)s, 15.5(3)s0a, 15.5(3)s1a, 15.5(3)s1, 15.5(3)s2a, 15.5(3)s2b, 15.5(3)s2, 15.5(3)s3a, 15.5(3)s3, 15.5(3)s4a, 15.5(3)s4b, 15.5(3)s4, 15.5(3)s4d, 15.5(3)s5, 15.5(3)sn, 15.6(1)s, 15.6(1)s1a, 15.6(1)s1, 15.6(1)s2, 15.6(1)s3, 15.6(1)s4, 15.6(1)t, 15.6(1)t0a, 15.6(1)t1, 15.6(1)t2, 15.6(2)s, 15.6(2)s0a, 15.6(2)s1, 15.6(2)s2, 15.6(2)s3, 15.6(2)s4, 15.6(2)sn, 15.6(2)sp, 15.6(2)sp1b, 15.6(2)sp1, 15.6(2)sp1c, 15.6(2)sp2a, 15.6(2)sp2, 15.6(2)sp3, 15.6(2)t, 15.6(2)t1, 15.6(2)t2, 15.6(2)t3, 15.6(3)m, 15.6(3)m0a, 15.6(3)m1b, 15.6(3)m1, 15.6(3)m2a, 15.6(3)m2, 15.6(3)m3, 15.7(3)m
- [CVE-2017-6736](https://www.precursorintelligence.com/what-is/cve-2017-6736) (Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability): 12.0 to 12.4, 15.0 to 15.6
- [CVE-2017-6737](https://www.precursorintelligence.com/what-is/cve-2017-6737) (Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability): 12.0 to 12.4, 15.0 to 15.6
- [CVE-2017-6738](https://www.precursorintelligence.com/what-is/cve-2017-6738) (Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability): 12.0 to 12.4, 15.0 to 15.6
- [CVE-2017-6739](https://www.precursorintelligence.com/what-is/cve-2017-6739) (Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability): 12.0 to 12.4, 15.0 to 15.6
- [CVE-2017-6740](https://www.precursorintelligence.com/what-is/cve-2017-6740) (Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability): 12.0 to 12.4, 15.0 to 15.6
- [CVE-2017-6743](https://www.precursorintelligence.com/what-is/cve-2017-6743) (Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability): 12.0 to 12.4, 15.0 to 15.6
- [CVE-2017-6744](https://www.precursorintelligence.com/what-is/cve-2017-6744) (Cisco IOS Software SNMP Remote Code Execution Vulnerability): 12.2(33)sxi, 12.2(33)sxi1, 12.2(50)se, 12.2(50)se1, 12.2(50)se2, 12.2(50)se3, 12.2(50)se4, 12.2(50)se5, 12.2(50)sg, 12.2(50)sg1, 12.2(50)sg2, 12.2(50)sg3, 12.2(50)sg4, 12.2(50)sg5, 12.2(50)sg6, 12.2(50)sg7, 12.2(50)sg8, 12.2(50)sq, 12.2(50)sq1, 12.2(50)sq2, 12.2(50)sq3, 12.2(50)sq4, 12.2(50)sq5, 12.2(50)sq6, 12.2(50)sq7, 12.2(52)ex, 12.2(52)ex1, 12.2(52)ey, 12.2(52)ey1b, 12.2(52)ey1, 12.2(52)ey1c, 12.2(52)ey2a, 12.2(52)ey2, 12.2(52)ey3a, 12.2(52)ey3, 12.2(52)ey4, 12.2(52)se, 12.2(52)se1, 12.2(52)sg, 12.2(52)xo, 12.2(53)ex, 12.2(53)ey, 12.2(53)ez, 12.2(53)se, 12.2(53)se1, 12.2(53)se2, 12.2(53)sg, 12.2(53)sg1, 12.2(53)sg2, 12.2(53)sg3, 12.2(53)sg4, 12.2(53)sg5, 12.2(53)sg6, 12.2(53)sg7, 12.2(53)sg8, 12.2(53)sg9, 12.2(53)sg10, 12.2(53)sg11, 12.2(54)se, 12.2(54)sg, 12.2(54)sg1, 12.2(54)wo, 12.2(54)xo, 12.2(55)ex, 12.2(55)ex1, 12.2(55)ex2, 12.2(55)ex3, 12.2(55)ey, 12.2(55)ez, 12.2(55)se, 12.2(55)se1, 12.2(55)se2, 12.2(55)se3, 12.2(55)se4, 12.2(55)se5, 12.2(55)se6, 12.2(55)se7, 12.2(55)se8, 12.2(55)se9, 12.2(55)se10, 12.2(55)se11, 12.2(58)ex, 12.2(58)ey, 12.2(58)ey1, 12.2(58)ey2, 12.2(58)ez, 12.2(58)se, 12.2(58)se1, 12.2(58)se2, 12.2(60)ez, 12.2(60)ez1, 12.2(60)ez2, 12.2(60)ez3, 12.2(60)ez4, 12.2(60)ez5, 12.2(60)ez6, 12.2(60)ez7, 12.2(60)ez8, 12.2(60)ez9, 12.2(60)ez10, 12.2(60)ez11, 15.0(1)ex, 15.0(1)ey, 15.0(1)ey1, 15.0(1)ey2, 15.0(1)se, 15.0(1)se1, 15.0(1)se2, 15.0(1)se3, 15.0(1)xo, 15.0(1)xo1, 15.0(2a)ex5, 15.0(2a)se9, 15.0(2)ea1, 15.0(2)eb, 15.0(2)ec, 15.0(2)ed, 15.0(2)ed1, 15.0(2)eh, 15.0(2)ej, 15.0(2)ej1, 15.0(2)ek, 15.0(2)ek1, 15.0(2)ex, 15.0(2)ex1, 15.0(2)ex2, 15.0(2)ex3, 15.0(2)ex4, 15.0(2)ex5, 15.0(2)ex8, 15.0(2)ex10, 15.0(2)ey, 15.0(2)ey1, 15.0(2)ey2, 15.0(2)ey3, 15.0(2)ez, 15.0(2)se, 15.0(2)se1, 15.0(2)se2, 15.0(2)se3, 15.0(2)se4, 15.0(2)se5, 15.0(2)se6, 15.0(2)se7, 15.0(2)se9, 15.0(2)se10a, 15.0(2)se10, 15.0(2)sg, 15.0(2)sg1, 15.0(2)sg2, 15.0(2)sg3, 15.0(2)sg4, 15.0(2)sg5, 15.0(2)sg6, 15.0(2)sg7, 15.0(2)sg8, 15.0(2)sg9, 15.0(2)sg10, 15.0(2)sg11, 15.0(2)sqd, 15.0(2)sqd1, 15.0(2)sqd2, 15.0(2)sqd3, 15.0(2)sqd5, 15.0(2)sqd6, 15.0(2)xo, 15.1(1)sg, 15.1(1)sg1, 15.1(1)sg2, 15.1(2)sg, 15.1(2)sg1, 15.1(2)sg2, 15.1(2)sg3, 15.1(2)sg4, 15.1(2)sg5, 15.1(2)sg6, 15.1(2)sg7, 15.1(2)sg8, 15.2(1)e, 15.2(1)e1, 15.2(1)e2, 15.2(1)e3, 15.2(1)ey, 15.2(1)sy, 15.2(1)sy0a, 15.2(1)sy1a, 15.2(1)sy1, 15.2(1)sy2, 15.2(1)sy3, 15.2(1)sy4, 15.2(2a)e1, 15.2(2)e, 15.2(2)e1, 15.2(2)e2, 15.2(2)e3, 15.2(2)e4, 15.2(2)e5a, 15.2(2)e5, 15.2(2)ea1, 15.2(2)ea2, 15.2(2)ea3, 15.2(2)eb, 15.2(2)eb1, 15.2(2)eb2, 15.2(2)gc, 15.2(2)sy, 15.2(2)sy1, 15.2(2)sy2, 15.2(2)t, 15.2(2)t1, 15.2(2)t2, 15.2(2)t3, 15.2(2)t4, 15.2(3a)e, 15.2(3m)e2, 15.2(3m)e3, 15.2(3)e, 15.2(3)e1, 15.2(3)e2, 15.2(3)e3, 15.2(3)ea, 15.2(3)gc, 15.2(3)gc1, 15.2(3)t, 15.2(3)t1, 15.2(3)t2, 15.2(3)t3, 15.2(3)t4, 15.2(4m)e1, 15.2(4m)e3, 15.2(4p)e1, 15.2(4)e, 15.2(4)e1, 15.2(4)e2, 15.2(4)e3, 15.2(4)e4, 15.2(4)ea, 15.2(4)ea1, 15.2(4)ea3, 15.2(4)ea4, 15.2(4)ec1, 15.2(4)gc, 15.2(4)gc1, 15.2(4)gc2, 15.2(4)gc3, 15.2(4)m, 15.2(4)m1, 15.2(4)m2, 15.2(4)m3, 15.2(4)m4, 15.2(4)m5, 15.2(4)m6a, 15.2(4)m6, 15.2(4)m7, 15.2(4)m8, 15.2(4)m9, 15.2(4)m10, 15.2(4)m11, 15.2(5a)e, 15.2(5a)e1, 15.2(5b)e, 15.2(5c)e, 15.2(5)e, 15.2(5)e1, 15.2(5)e2a, 15.2(5)e2, 15.2(5)ea, 15.2(5)ex, 15.3(1)sy, 15.3(1)sy2, 15.3(1)t, 15.3(1)t1, 15.3(1)t2, 15.3(1)t3, 15.3(1)t4, 15.3(2)t, 15.3(2)t1, 15.3(2)t2, 15.3(2)t3, 15.3(2)t4, 15.3(3)m, 15.3(3)m1, 15.3(3)m2, 15.3(3)m3, 15.3(3)m4, 15.3(3)m5, 15.3(3)m6, 15.3(3)m7, 15.3(3)m9, 15.4(1)cg, 15.4(1)cg1, 15.4(1)sy, 15.4(1)sy1, 15.4(1)sy2, 15.4(1)t, 15.4(1)t1, 15.4(1)t2, 15.4(1)t3, 15.4(1)t4, 15.4(2)cg, 15.4(2)t, 15.4(2)t1, 15.4(2)t2, 15.4(2)t3, 15.4(2)t4, 15.4(3)m, 15.4(3)m1, 15.4(3)m2, 15.4(3)m3, 15.4(3)m4, 15.4(3)m5, 15.4(3)m6a, 15.4(3)m6, 15.4(3)m7, 15.5(1)sy, 15.5(1)t, 15.5(1)t1, 15.5(1)t2, 15.5(1)t3, 15.5(1)t4, 15.5(2)t, 15.5(2)t1, 15.5(2)t2, 15.5(2)t3, 15.5(2)t4, 15.5(3)m0a, 15.5(3)m1, 15.5(3)m2, 15.5(3)m3, 15.5(3)m4a, 15.5(3)m4, 15.5(3)m5, 15.5(3)m6, 15.6(1)t, 15.6(1)t0a, 15.6(1)t1, 15.6(1)t2, 15.6(2)t, 15.6(2)t1, 15.6(2)t2, 15.6(3)m, 15.6(3)m0a, 15.6(3)m1b, 15.6(3)m1, 15.6(3)m2a, 15.6(3)m2, 15.6(3)m3
- [CVE-2018-0155](https://www.precursorintelligence.com/what-is/cve-2018-0155) (Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability): 3.6(2)e
- [CVE-2018-0156](https://www.precursorintelligence.com/what-is/cve-2018-0156) (Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability): 15.2(2a)ja, 15.2(2)e4
- [CVE-2018-0158](https://www.precursorintelligence.com/what-is/cve-2018-0158) (Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability): 15.5(3)s1.1, 15.5(3)s1.2, 15.5(3)s1.4, 15.5(3)s1.5, 15.5(3)s1.7, 15.5(3)s1.8, 15.5(3)s1.9, 15.5(3)s1.10, 15.5(3)s1.11, 15.5(3)s1.12
- [CVE-2018-0159](https://www.precursorintelligence.com/what-is/cve-2018-0159) (Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability): 15.3(3)s
- [CVE-2018-0161](https://www.precursorintelligence.com/what-is/cve-2018-0161) (Cisco IOS Software Resource Management Errors Vulnerability): 15.2(5)e
- [CVE-2018-0167](https://www.precursorintelligence.com/what-is/cve-2018-0167) (Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability): up to 15.6.3m1, up to 15.2(6)e0a, up to 15.2(4a)ea5
- [CVE-2017-12231](https://www.precursorintelligence.com/what-is/cve-2017-12231) (Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability): 12.4 to 15.6
- [CVE-2017-12233](https://www.precursorintelligence.com/what-is/cve-2017-12233) (Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability): 12.4 to 15.6

1 more exploited flaw names IOS without a version of its own (for example as the system other affected software runs on). They are in the list below.

Checked: the 30 most recently added of 38 exploited flaws.

## Which IOS vulnerabilities are being exploited?

38 flaws are on the government list of vulnerabilities known to be exploited, newest first:

- [CVE-2008-4128](https://www.precursorintelligence.com/what-is/cve-2008-4128): Cisco IOS Cross-Site Request Forgery Vulnerability. High, CVSS 8.1, chance of use in 30 days 34%, known exploited since 13 July 2026.
- [CVE-2023-20109](https://www.precursorintelligence.com/what-is/cve-2023-20109): Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability. Medium, CVSS 6.6, chance of use in 30 days 2.5%, known exploited since 10 October 2023.
- [CVE-2004-1464](https://www.precursorintelligence.com/what-is/cve-2004-1464): Cisco IOS Denial-of-Service Vulnerability. Medium, CVSS 5.9, chance of use in 30 days 4.8%, known exploited since 19 May 2023.
- [CVE-2016-6415](https://www.precursorintelligence.com/what-is/cve-2016-6415): Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability. High, CVSS 7.5, chance of use in 30 days 88%, known exploited since 19 May 2023.
- [CVE-2017-6742](https://www.precursorintelligence.com/what-is/cve-2017-6742): Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days 21%, known exploited since 19 April 2023.
- [CVE-2017-3881](https://www.precursorintelligence.com/what-is/cve-2017-3881): Cisco IOS and IOS XE Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 99%, known exploited since 25 March 2022.
- [CVE-2017-12234](https://www.precursorintelligence.com/what-is/cve-2017-12234): Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability. High, CVSS 7.5, chance of use in 30 days 7.1%, known exploited since 3 March 2022.
- [CVE-2017-12235](https://www.precursorintelligence.com/what-is/cve-2017-12235): Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability. High, CVSS 7.5, chance of use in 30 days 7.1%, known exploited since 3 March 2022.
- [CVE-2017-12237](https://www.precursorintelligence.com/what-is/cve-2017-12237): Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability. High, CVSS 7.5, chance of use in 30 days 7.1%, known exploited since 3 March 2022.
- [CVE-2017-12238](https://www.precursorintelligence.com/what-is/cve-2017-12238): Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 2.0%, known exploited since 3 March 2022.
- [CVE-2017-12240](https://www.precursorintelligence.com/what-is/cve-2017-12240): Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 14%, known exploited since 3 March 2022.
- [CVE-2017-12319](https://www.precursorintelligence.com/what-is/cve-2017-12319): Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability. Medium, CVSS 5.9, chance of use in 30 days 5.2%, known exploited since 3 March 2022.
- [CVE-2017-6627](https://www.precursorintelligence.com/what-is/cve-2017-6627): Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability. High, CVSS 7.5, chance of use in 30 days 6.2%, known exploited since 3 March 2022.
- [CVE-2017-6663](https://www.precursorintelligence.com/what-is/cve-2017-6663): Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 2.1%, known exploited since 3 March 2022.
- [CVE-2017-6736](https://www.precursorintelligence.com/what-is/cve-2017-6736): Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days 70%, known exploited since 3 March 2022.
- [CVE-2017-6737](https://www.precursorintelligence.com/what-is/cve-2017-6737): Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days 45%, known exploited since 3 March 2022.
- [CVE-2017-6738](https://www.precursorintelligence.com/what-is/cve-2017-6738): Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days 11%, known exploited since 3 March 2022.
- [CVE-2017-6739](https://www.precursorintelligence.com/what-is/cve-2017-6739): Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days 11%, known exploited since 3 March 2022.
- [CVE-2017-6740](https://www.precursorintelligence.com/what-is/cve-2017-6740): Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days 11%, known exploited since 3 March 2022.
- [CVE-2017-6743](https://www.precursorintelligence.com/what-is/cve-2017-6743): Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days 11%, known exploited since 3 March 2022.
- [CVE-2017-6744](https://www.precursorintelligence.com/what-is/cve-2017-6744): Cisco IOS Software SNMP Remote Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days 7.3%, known exploited since 3 March 2022.
- [CVE-2018-0154](https://www.precursorintelligence.com/what-is/cve-2018-0154): Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability. High, CVSS 7.5, chance of use in 30 days 7.1%, known exploited since 3 March 2022.
- [CVE-2018-0155](https://www.precursorintelligence.com/what-is/cve-2018-0155): Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability. High, CVSS 8.6, chance of use in 30 days 7.7%, known exploited since 3 March 2022.
- [CVE-2018-0156](https://www.precursorintelligence.com/what-is/cve-2018-0156): Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability. High, CVSS 7.5, chance of use in 30 days 9.4%, known exploited since 3 March 2022.
- [CVE-2018-0158](https://www.precursorintelligence.com/what-is/cve-2018-0158): Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability. High, CVSS 8.6, chance of use in 30 days 7.2%, known exploited since 3 March 2022.
- [CVE-2018-0159](https://www.precursorintelligence.com/what-is/cve-2018-0159): Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability. High, CVSS 7.5, chance of use in 30 days 6.9%, known exploited since 3 March 2022.
- [CVE-2018-0161](https://www.precursorintelligence.com/what-is/cve-2018-0161): Cisco IOS Software Resource Management Errors Vulnerability. Medium, CVSS 6.3, chance of use in 30 days 4.1%, known exploited since 3 March 2022.
- [CVE-2018-0167](https://www.precursorintelligence.com/what-is/cve-2018-0167): Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability. High, CVSS 8.8, chance of use in 30 days 3.4%, known exploited since 3 March 2022.
- [CVE-2017-12231](https://www.precursorintelligence.com/what-is/cve-2017-12231): Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability. High, CVSS 7.5, chance of use in 30 days 7.1%, known exploited since 3 March 2022.
- [CVE-2017-12233](https://www.precursorintelligence.com/what-is/cve-2017-12233): Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability. High, CVSS 7.5, chance of use in 30 days 7.1%, known exploited since 3 March 2022.
- [CVE-2017-12232](https://www.precursorintelligence.com/what-is/cve-2017-12232): Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 2.2%, known exploited since 3 March 2022.
- [CVE-2018-0172](https://www.precursorintelligence.com/what-is/cve-2018-0172): Cisco IOS and IOS XE Software Improper Input Validation Vulnerability. High, CVSS 8.6, chance of use in 30 days 7.8%, known exploited since 3 March 2022.
- [CVE-2018-0173](https://www.precursorintelligence.com/what-is/cve-2018-0173): Cisco IOS and IOS XE Software Improper Input Validation Vulnerability. High, CVSS 8.6, chance of use in 30 days 7.6%, known exploited since 3 March 2022.
- [CVE-2018-0174](https://www.precursorintelligence.com/what-is/cve-2018-0174): Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability. High, CVSS 8.6, chance of use in 30 days 7.6%, known exploited since 3 March 2022.
- [CVE-2018-0175](https://www.precursorintelligence.com/what-is/cve-2018-0175): Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability. High, CVSS 8.0, chance of use in 30 days 3.5%, known exploited since 3 March 2022.
- [CVE-2018-0179](https://www.precursorintelligence.com/what-is/cve-2018-0179): Cisco IOS Software Denial-of-Service Vulnerability. Medium, CVSS 5.9, chance of use in 30 days 4.9%, known exploited since 3 March 2022.
- [CVE-2018-0180](https://www.precursorintelligence.com/what-is/cve-2018-0180): Cisco IOS Software Denial-of-Service Vulnerability. Medium, CVSS 5.9, chance of use in 30 days 4.9%, known exploited since 3 March 2022.
- [CVE-2018-0171](https://www.precursorintelligence.com/what-is/cve-2018-0171): Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021.

## Which IOS flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days):

- [CVE-2018-0171](https://www.precursorintelligence.com/what-is/cve-2018-0171): >99%, Critical (CVSS 9.8), known exploited
- [CVE-2017-3881](https://www.precursorintelligence.com/what-is/cve-2017-3881): 99%, Critical (CVSS 9.8), known exploited
- [CVE-1999-0016](https://www.precursorintelligence.com/what-is/cve-1999-0016): 96%, Medium (CVSS 5.0)
- [CVE-2016-6415](https://www.precursorintelligence.com/what-is/cve-2016-6415): 88%, High (CVSS 7.5), known exploited
- [CVE-2002-1359](https://www.precursorintelligence.com/what-is/cve-2002-1359): 80%, Critical (CVSS 10.0)
- [CVE-2017-6736](https://www.precursorintelligence.com/what-is/cve-2017-6736): 70%, High (CVSS 8.8), known exploited
- [CVE-2001-0537](https://www.precursorintelligence.com/what-is/cve-2001-0537): 68%, Critical (CVSS 9.3)
- [CVE-2017-6737](https://www.precursorintelligence.com/what-is/cve-2017-6737): 45%, High (CVSS 8.8), known exploited

## Questions

### How many vulnerabilities does IOS have?

We track 598 published vulnerabilities listed under the name IOS, across 8,443 versions. The most recent IOS flaw added to the known-exploited list is CVE-2008-4128, on 13 July 2026.

### Which IOS vulnerabilities are being exploited?

38 are on the list of flaws known to be exploited. The most recently added are CVE-2008-4128, CVE-2023-20109 and CVE-2004-1464.

### Why are newer IOS flaws missing from this page?

Cisco also lists IOS under more specific names, such as IOS XE and IOS XR. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.

### Which versions of IOS do the exploited flaws affect?

Each flaw names its own versions, usually as ranges. The newest, CVE-2008-4128, affects 12.4. The versions for every exploited flaw are listed on this page.

### How do I get alerts for IOS?

Create a Precursor Intelligence account and track IOS. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.

## Running IOS?

Precursor Intelligence keeps checking for you:

- **Tell us what you run.** Pick your software from a list, or let us work it out from your website.
- **We match it to every flaw.** Over 400,000 published flaws, checked against your list.
- **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it.
- **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools.

Start free (no card, nothing to install): https://www.precursorintelligence.com/register
Book a demo: https://www.precursorintelligence.com/contact