Ios XE SD-WAN vulnerabilitiesAnd the versions its exploited flaws hit.
Ios XE SD-WAN is made by Cisco. We track 26 published vulnerabilities listed under that exact name, across 49 versions. 1 of them is on the list of flaws known to be exploited, the newest added on 29 September 2025. Cisco lists newer releases under their own names, such as Ios XE SD-WAN 16.10.1 When Installed on 4000 Series Integrated Services, so check those pages too.
The most recent Ios XE SD-WAN flaw added to the known-exploited list is CVE-2025-20352, on 29 September 2025. We keep watching the known-exploited list.
Is Ios XE SD-WAN listed under other names? Yes.
Cisco also lists Ios XE SD-WAN under more specific names, such as Ios XE SD-WAN 16.10.1 When Installed on 4000 Series Integrated Services and Ios XE SD-WAN 16.10.1 When Installed on ASR 1000 Series Aggregation Services. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
- Ios XE SD-WAN 16.10.1 When Installed on 4000 Series Integrated Services1 published vulnerability
- Ios XE SD-WAN 16.10.1 When Installed on ASR 1000 Series Aggregation Services1 published vulnerability
- Ios XE SD-WAN 16.10.1 When Installed on Integrated Services Virtual1 published vulnerability
- Ios XE SD-WAN 16.10.2 When Installed on 1000 Series Integrated Services1 published vulnerability
- Ios XE SD-WAN 16.10.2 When Installed on 4000 Series Integrated Services1 published vulnerability
- Ios XE SD-WAN 16.10.2 When Installed on ASR 1000 Series Aggregation Services1 published vulnerability
- Ios XE SD-WAN 16.10.2 When Installed on Integrated Services Virtual1 published vulnerability
- Ios XE SD-WAN 16.10.3a When Installed on 1000 Series Integrated Services1 published vulnerability
- Ios XE SD-WAN 16.10.3a When Installed on 4000 Series Integrated Services1 published vulnerability
- Ios XE SD-WAN 16.10.3a When Installed on ASR 1000 Series Aggregation Services1 published vulnerability
- Ios XE SD-WAN 16.10.3a When Installed on Cloud Services Router 1000v1 published vulnerability
- Ios XE SD-WAN 16.10.1 When Installed on 1000 Series Integrated Services1 published vulnerability
Which versions of Ios XE SD-WAN do the exploited flaws hit?
Each exploited flaw lists the versions it affects, as published by the vendor. Find your version, then patch.
- CVE-2025-20352Exploited list, 29 Sep 2025
Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability
16.9.116.9.216.9.316.9.416.10.116.10.216.10.3a16.10.3b
Which Ios XE SD-WAN vulnerabilities are being exploited?
1 flaw is on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 7.7Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability
Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution.
Which Ios XE SD-WAN flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 40%
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following: An authenticated, remote attacker with low privileges could cause...
- 3.9%CVE-2020-3375Critical
A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device.
- 2.6%CVE-2021-34727Critical
A vulnerability in the vDaemon process in Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device.
- 2.2%CVE-2021-1300Critical
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device.
- 2.1%CVE-2021-1301Critical
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device.
- 1.9%CVE-2021-1274High
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device.
- 1.9%CVE-2021-1273High
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device.
- 1.8%CVE-2021-1619Critical
A vulnerability in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass NETCONF or RESTCONF authentication and do either...
- 1.7%CVE-2021-1278High
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device.
- 1.4%CVE-2021-1279High
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device.
Running Ios XE SD-WAN? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.
- Matched to
- Ios XE SD-WAN on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 26 published vulnerabilities listed under the name Ios XE SD-WAN, across 49 versions. The most recent Ios XE SD-WAN flaw added to the known-exploited list is CVE-2025-20352, on 29 September 2025.
1 is on the list of flaws known to be exploited. The most recently added is CVE-2025-20352.
Cisco also lists Ios XE SD-WAN under more specific names, such as Ios XE SD-WAN 16.10.1 When Installed on 4000 Series Integrated Services and Ios XE SD-WAN 16.10.1 When Installed on ASR 1000 Series Aggregation Services. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Each flaw names its own versions, usually as ranges. The newest, CVE-2025-20352, affects 16.9.1, 16.9.2, 16.9.3, 16.9.4 and more. The versions for every exploited flaw are listed on this page.
Create a Precursor Intelligence account and track Ios XE SD-WAN. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.