Firewalls, VPNs and network gear: vulnerabilities and fixes

Cisco, Fortinet, Palo Alto, Citrix, F5, Juniper, Ivanti, SonicWall and VPN products. 139 CVEs tracked.

Firewalls, VPNs and network gear has 139 tracked vulnerabilities, 36 critical and 28 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 105. Most recent: 2026-10-23. Highest priority: CVE-2024-21762 (score 100/100).

• CVE-2024-21762 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Fortinet FortiOS Out-of-Bound Write Vulnerability
• CVE-2026-20079 CRITICAL 10.0 EXPLOITED DOWNGRADE Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2026-88771 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Citrix NetScaler Improper Input Validation Vulnerability
• CVE-2026-16232 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Check Point SmartConsole Improper Authentication Vulnerability
• CVE-2026-19490 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2026-83548 CRITICAL 10.0 EXPLOITED UPGRADE UPGRADE SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
• CVE-2026-86060 CRITICAL 9.8 EXPLOITED UPGRADE MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
• CVE-2026-76460 CRITICAL 10.0 EXPLOITED DOWNGRADE DOWNGRADE Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
• CVE-2026-94127 CRITICAL 9.8 EXPLOITED UPGRADE F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
• CVE-2026-76461 CRITICAL 9.8 EXPLOITED UPGRADE Cisco Secure Email Gateway SQL Injection Vulnerability
• CVE-2026-85102 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Check Point Multiple Products Improper Certificate Validation Vulnerability
• CVE-2026-93616 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Check Point Multiple Products Path Traversal Vulnerability
• CVE-2015-5477 HIGH 7.5 EXPLOITED UPGRADE MITIGATE ISC BIND Data Processing Errors Vulnerability
• CVE-2026-104935 HIGH 8.6 EXPLOITED UPGRADE Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
• CVE-2026-76519 CRITICAL 9.8 EXPLOITED UPGRADE Cisco Secure Email Gateway Relative Path Traversal Vulnerability
• CVE-2026-88772 HIGH 8.1 EXPLOITED UPGRADE UPGRADE Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
• CVE-2026-104286 CRITICAL 9.8 EXPLOITED UPGRADE Fortinet FortiMail Path Traversal Vulnerability
• CVE-2026-76504 CRITICAL 9.8 EXPLOITED UPGRADE Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
• CVE-2025-25249 HIGH 8.1 EXPLOITED UPGRADE UPGRADE Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
• CVE-2026-8452 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
• CVE-2026-67277 HIGH 8.2 EXPLOITED UPGRADE MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
• CVE-2026-7273 HIGH 8.8 EXPLOITED MITIGATE MITIGATE Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
• CVE-2026-83549 HIGH 7.8 EXPLOITED UPGRADE UPGRADE SonicWall SMA1000 Appliances OS Command Injection Vulnerability
• CVE-2026-20316 MEDIUM 5.3 EXPLOITED UPGRADE Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
• CVE-2026-67279 MEDIUM 6.5 EXPLOITED UPGRADE Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
• CVE-2026-109618 CRITICAL 9.8 UPGRADE MITIGATE PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques
• CVE-2026-88779 HIGH 7.5 EXPLOITED UPGRADE UPGRADE Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
• CVE-2026-0322 HIGH 7.2 EXPLOITED UPGRADE Palo Alto Networks PAN-OS Code Injection Vulnerability
• CVE-2026-109619 HIGH 8.1 UPGRADE MITIGATE PHP has various global state that temporarily points into request memory
• CVE-2026-71993 CRITICAL 9.8 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn fu
• CVE-2025-61624 MEDIUM 6.0 EXPLOITED UPGRADE UPGRADE Fortinet Multiple Products Path Traversal Vulnerability
• CVE-2026-13206 CRITICAL 9.8 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zy
• CVE-2026-79857 CRITICAL 9.8 There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of
• CVE-2026-53921 CRITICAL 9.8 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt
• CVE-2026-69096 HIGH 8.8 OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC bac
• CVE-2026-26035 CRITICAL 9.8 UPGRADE An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, For
• CVE-2026-72603 CRITICAL 9.9 An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to exe
• CVE-2026-20272 CRITICAL 9.8 MITIGATE As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software eng
• CVE-2026-18129 HIGH 8.1 Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7
• CVE-2026-79860 CRITICAL 9.8 Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated rem
• CVE-2026-18125 HIGH 7.5 An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthen
• CVE-2026-76466 CRITICAL 9.8 A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, rem
• CVE-2026-53918 HIGH 8.8 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt
• CVE-2026-69095 HIGH 7.5 OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnera
• CVE-2026-76473 CRITICAL 9.8 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco E
• CVE-2026-76474 CRITICAL 9.8 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco E
• CVE-2026-61609 HIGH 7.5 Pterodactyl is a free, open-source game server management panel
• CVE-2026-20263 HIGH 8.6 MITIGATE A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software could allow
• CVE-2026-53920 HIGH 8.7 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt
• CVE-2026-20268 HIGH 8.6 MITIGATE As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software eng
• CVE-2026-20269 HIGH 8.6 MITIGATE As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software eng
• CVE-2026-20270 HIGH 8.6 MITIGATE As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software eng
• CVE-2026-20271 HIGH 8.6 MITIGATE As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software eng
• CVE-2026-20273 HIGH 8.6 MITIGATE As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software eng
• CVE-2026-20303 CRITICAL 9.9 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN eng
• CVE-2026-20200 HIGH 8.8 MITIGATE A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attack
• CVE-2026-20267 CRITICAL 9.0 MITIGATE As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software eng
• CVE-2026-20304 CRITICAL 9.9 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN eng
• CVE-2026-20310 CRITICAL 9.1 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN eng
• CVE-2026-6837 HIGH 7.2 A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmwar
• CVE-2026-70465 HIGH 8.1 UPGRADE A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClient
• CVE-2026-20348 HIGH 7.5 UPGRADE UPGRADE A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cau
• CVE-2026-70468 HIGH 8.1 UPGRADE UPGRADE A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, Forti
• CVE-2026-76302 CRITICAL 9.9 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh
• CVE-2026-76531 CRITICAL 9.9 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh
• CVE-2026-20043 CRITICAL 9.0 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source S
• CVE-2026-0298 HIGH 8.1 UPGRADE An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of
• CVE-2026-12984 HIGH 8.2 Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitiv
• CVE-2026-18127 HIGH 7.7 External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote
• CVE-2026-99059 HIGH 7.7 In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consump
• CVE-2026-0297 HIGH 8.1 UPGRADE UPGRADE A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-
• CVE-2026-113779 HIGH 8.8 The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plu
• CVE-2026-76299 CRITICAL 9.9 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh
• CVE-2026-55606 MEDIUM 6.5 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt
• CVE-2026-76477 HIGH 8.8 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco E
• CVE-2026-20124 HIGH 7.7 MITIGATE A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allo
• CVE-2026-76476 HIGH 8.8 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco E
• CVE-2026-79977 HIGH 8.2 The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could n
• CVE-2025-57739 HIGH 8.8 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89]
• CVE-2026-20312 HIGH 8.8 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN eng
• CVE-2026-20313 HIGH 7.7 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN eng
• CVE-2026-73325 HIGH 7.8 Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that a
• CVE-2026-89035 HIGH 7.4 MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that al
• CVE-2026-71407 MEDIUM 5.6 UPGRADE A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 ma
• CVE-2026-115325 HIGH 8.3 Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allo
• CVE-2026-20218 MEDIUM 5.8 A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco prod
• CVE-2026-76530 HIGH 8.8 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh
• CVE-2026-0296 HIGH 7.4 UPGRADE UPGRADE Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthentic
• CVE-2026-71408 MEDIUM 5.3 UPGRADE A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6,
• CVE-2026-76390 MEDIUM 5.3 UPGRADE In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could
• CVE-2026-23705 HIGH 7.2 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]
• CVE-2026-57208 MEDIUM 6.2 Entire CLI hooks into Git workflows to capture AI agent sessions
• CVE-2026-66149 HIGH 7.8 Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security applia
• CVE-2026-66150 HIGH 7.8 Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security applia
• CVE-2026-76478 HIGH 8.8 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco E
• CVE-2026-0299 HIGH 7.8 UPGRADE UPGRADE Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to
• CVE-2026-115883 MEDIUM 6.0 LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and
• CVE-2026-48121 MEDIUM 6.7 @langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses Mongo
• CVE-2026-6374 HIGH 7.3 Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within a
• CVE-2026-70466 MEDIUM 5.3 UPGRADE A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0
• CVE-2026-76479 HIGH 7.8 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco E
• CVE-2026-8508 MEDIUM 6.5 An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versi
• CVE-2026-0294 HIGH 7.8 UPGRADE A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and ma
• CVE-2026-20291 HIGH 7.8 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source S
• CVE-2026-76494 HIGH 7.8 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series s
• CVE-2026-76495 HIGH 7.8 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series s
• CVE-2026-23706 MEDIUM 6.5 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]
• CVE-2026-6373 MEDIUM 6.5 Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH
• CVE-2026-69112 HIGH 7.1 Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and
• CVE-2026-0289 MEDIUM 6.5 UPGRADE A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enabl
• CVE-2026-20289 MEDIUM 5.7 UPGRADE UPGRADE A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low
• CVE-2026-20311 MEDIUM 6.3 A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, r
• CVE-2026-0295 HIGH 7.0 UPGRADE A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-
• CVE-2026-14227 MEDIUM 4.9 An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insuffic
• CVE-2026-76496 HIGH 7.0 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series s
• CVE-2026-20028 MEDIUM 5.0 A vulnerability in the network driver of Cisco Terminal Service (TS) Agent could allow an authenticated, remot
• CVE-2026-49131 MEDIUM 5.4 OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attacker
• CVE-2026-75104 MEDIUM 5.5 Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to r
• CVE-2026-20294 MEDIUM 6.5 A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenti
• CVE-2026-65920 MEDIUM 4.3 Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpo
• CVE-2026-0292 MEDIUM 6.0 UPGRADE An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Win
• CVE-2026-0293 MEDIUM 6.0 UPGRADE A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administra
• CVE-2026-20308 MEDIUM 4.3 A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, r
• CVE-2026-49132 MEDIUM 5.4 OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attacker
• CVE-2026-0290 MEDIUM 5.5 UPGRADE An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Brows
• CVE-2026-18751 MEDIUM 5.2 External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue affects Work
• CVE-2026-66151 MEDIUM 5.5 SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory re
• CVE-2026-76462 MEDIUM 5.5 A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco
• CVE-2026-70467 LOW 3.8 UPGRADE A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2,
• CVE-2026-0291 MEDIUM 4.4 UPGRADE An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access A
• CVE-2026-19380 LOW 2.3 A vulnerability was identified in Mullvad wireguard.sys 0.10.1
• CVE-2026-76300 HIGH n/a As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh
• CVE-2026-76301 HIGH n/a As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh
• CVE-2026-76408 HIGH n/a As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh
• CVE-2026-76526 HIGH n/a As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh
• CVE-2026-76529 HIGH n/a As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh
• CVE-2026-76407 HIGH n/a As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh
• CVE-2026-76527 HIGH n/a As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh
• CVE-2026-76528 HIGH n/a As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh

FAQ

How do I fix Firewalls, VPNs and network gear vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Firewalls, VPNs and network gear being exploited right now?

Yes: 28 Firewalls, VPNs and network gear CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which Firewalls, VPNs and network gear CVE should I patch first?

CVE-2024-21762 currently ranks highest (100/100): Fortinet FortiOS Out-of-Bound Write Vulnerability.

Software in this group

People search for: firewall, vpn, cisco, fortinet, palo alto, router.

← Back to latest CVEs