Cisco ASA vulnerabilities: known CVEs & security history
Cisco · Network / Security · 149 tracked CVEs · 11 actively exploited · updated September 2026 · what is a CVE? →
This is the full list of known vulnerabilities (CVEs) across all Cisco ASA release lines — 149 in total, with 11 actively exploited in the wild. A CVE here doesn't mean your version is affected — check Cisco ASA's current status and the safe version to run.
Known Cisco ASA CVEs
Actively-exploited and most-severe first. Showing the top 80 of 149. Open any CVE for full details.
| CVE | Severity | CVSS | EPSS | Year |
|---|---|---|---|---|
| CVE-2025-20333⚡ exploited | critical | 9.9 | 40% | 2025 |
| CVE-2026-20349⚡ exploited | high | 8.6 | 1% | 2026 |
| CVE-2024-20353⚡ exploited | high | 8.6 | 71% | 2024 |
| CVE-2020-3452⚡ exploited | high | 7.5 | 100% | 2020 |
| CVE-2020-3259⚡ exploited | high | 7.5 | 69% | 2020 |
| CVE-2018-0296⚡ exploited | high | 7.5 | 100% | 2018 |
| CVE-2025-20362⚡ exploited | medium | 6.5 | 86% | 2025 |
| CVE-2020-3580⚡ exploited | medium | 6.1 | 86% | 2020 |
| CVE-2024-20359⚡ exploited | medium | 6 | 19% | 2024 |
| CVE-2024-20481⚡ exploited | medium | 5.8 | 16% | 2024 |
| CVE-2023-20269⚡ exploited | medium | 5 | 22% | 2023 |
| CVE-2018-0101 | critical | 10 | 87% | 2018 |
| CVE-2020-3187 | critical | 9.1 | 97% | 2020 |
| CVE-2025-20363 | critical | 9 | 8% | 2025 |
| CVE-2022-20759 | high | 8.8 | 29% | 2022 |
| CVE-2026-20103 | high | 8.6 | 0% | 2026 |
| CVE-2026-20101 | high | 8.6 | 0% | 2026 |
| CVE-2026-20039 | high | 8.6 | 0% | 2026 |
| CVE-2025-20182 | high | 8.6 | 1% | 2025 |
| CVE-2024-20495 | high | 8.6 | 1% | 2024 |
| CVE-2024-20494 | high | 8.6 | 1% | 2024 |
| CVE-2024-20426 | high | 8.6 | 1% | 2024 |
| CVE-2024-20402 | high | 8.6 | 1% | 2024 |
| CVE-2023-20095 | high | 8.6 | 1% | 2023 |
| CVE-2023-20086 | high | 8.6 | 1% | 2023 |
| CVE-2023-20006 | high | 8.6 | 1% | 2023 |
| CVE-2022-20947 | high | 8.6 | 1% | 2022 |
| CVE-2022-20760 | high | 8.6 | 2% | 2022 |
| CVE-2022-20745 | high | 8.6 | 1% | 2022 |
| CVE-2022-20715 | high | 8.6 | 1% | 2022 |
| CVE-2021-34704 | high | 8.6 | 1% | 2022 |
| CVE-2021-1573 | high | 8.6 | 1% | 2022 |
| CVE-2021-40118 | high | 8.6 | 1% | 2021 |
| CVE-2021-40117 | high | 8.6 | 1% | 2021 |
| CVE-2021-34793 | high | 8.6 | 1% | 2021 |
| CVE-2021-34792 | high | 8.6 | 1% | 2021 |
| CVE-2021-34783 | high | 8.6 | 2% | 2021 |
| CVE-2021-1504 | high | 8.6 | 2% | 2021 |
| CVE-2021-1501 | high | 8.6 | 1% | 2021 |
| CVE-2021-1445 | high | 8.6 | 2% | 2021 |
| CVE-2020-3572 | high | 8.6 | 2% | 2020 |
| CVE-2020-3529 | high | 8.6 | 2% | 2020 |
| CVE-2020-3528 | high | 8.6 | 1% | 2020 |
| CVE-2020-3436 | high | 8.6 | 2% | 2020 |
| CVE-2020-3373 | high | 8.6 | 2% | 2020 |
| CVE-2020-3304 | high | 8.6 | 4% | 2020 |
| CVE-2020-3196 | high | 8.6 | 2% | 2020 |
| CVE-2020-3191 | high | 8.6 | 2% | 2020 |
| CVE-2019-15256 | high | 8.6 | 2% | 2019 |
| CVE-2019-1714 | high | 8.6 | 2% | 2019 |
| CVE-2019-1708 | high | 8.6 | 2% | 2019 |
| CVE-2019-1694 | high | 8.6 | 3% | 2019 |
| CVE-2018-15388 | high | 8.6 | 2% | 2019 |
| CVE-2018-15454 | high | 8.6 | 4% | 2018 |
| CVE-2018-0240 | high | 8.6 | 4% | 2018 |
| CVE-2018-0231 | high | 8.6 | 5% | 2018 |
| CVE-2018-0230 | high | 8.6 | 2% | 2018 |
| CVE-2018-0228 | high | 8.6 | 4% | 2018 |
| CVE-2021-1493 | high | 8.5 | 1% | 2021 |
| CVE-2020-3167 | high | 7.8 | 0% | 2020 |
| CVE-2026-20105 | high | 7.7 | 0% | 2026 |
| CVE-2026-20100 | high | 7.7 | 0% | 2026 |
| CVE-2026-20049 | high | 7.7 | 0% | 2026 |
| CVE-2026-20014 | high | 7.7 | 0% | 2026 |
| CVE-2025-20127 | high | 7.7 | 1% | 2025 |
| CVE-2024-20408 | high | 7.7 | 0% | 2024 |
| CVE-2024-20268 | high | 7.7 | 1% | 2024 |
| CVE-2022-20927 | high | 7.7 | 0% | 2022 |
| CVE-2022-20924 | high | 7.7 | 1% | 2022 |
| CVE-2021-1422 | high | 7.7 | 1% | 2021 |
| CVE-2020-3554 | high | 7.5 | 3% | 2020 |
| CVE-2020-3306 | high | 7.5 | 1% | 2020 |
| CVE-2020-3305 | high | 7.5 | 1% | 2020 |
| CVE-2020-3303 | high | 7.5 | 1% | 2020 |
| CVE-2020-3298 | high | 7.5 | 2% | 2020 |
| CVE-2020-3254 | high | 7.5 | 2% | 2020 |
| CVE-2020-3195 | high | 7.5 | 2% | 2020 |
| CVE-2019-12698 | high | 7.5 | 2% | 2019 |
| CVE-2019-12678 | high | 7.5 | 2% | 2019 |
| CVE-2019-12673 | high | 7.5 | 2% | 2019 |
69 older / lower-severity CVEs not shown — see Cisco ASA's full record.
Is my Cisco ASA version affected?
The list above spans every release. To know whether your version is affected — and the minimum safe version to upgrade to — check it directly.
Check your Cisco ASA version → · Monitor Cisco ASA for new CVEs →
Cisco ASA vulnerabilities — frequently asked
How many known vulnerabilities does Cisco ASA have?
IsItPatched tracks 149 CVEs for Cisco ASA, 11 of which are actively exploited (CISA KEV). 4 are critical-severity and 79 high-severity. These span every release line — what matters is whether the version you run is affected.
Does Cisco ASA have any actively-exploited vulnerabilities?
Yes — 11 Cisco ASA CVEs are in CISA's Known Exploited Vulnerabilities catalog, meaning they are confirmed exploited in the wild (3 linked to ransomware). Patch these as a priority.
What is the most severe Cisco ASA vulnerability?
Among tracked issues, CVE-2025-20333 (CRITICAL, CVSS 9.9), which is actively exploited, ranks highest — a Buffer overflow weakness.
Is Cisco ASA safe to use?
It depends on the version. The latest supported Cisco ASA release clears the known issues; older versions may still be affected. Check the exact version you run for a verdict.
CVE data aggregated from NVD, CISA KEV and EPSS (FIRST.org). Related: Cisco ASA security status · Cisco ASA end-of-life · actively-exploited CVEs. Always verify against Cisco's advisories — see our disclaimer.