# Cisco

[19 tracked vendors](https://thirdpartyindex.com/vendors/cisco#used-by) name Cisco as a subprocessor, including [Rackspace](https://thirdpartyindex.com/vendors/rackspace), [Rapid7](https://thirdpartyindex.com/vendors/rapid7) and [GoDaddy](https://thirdpartyindex.com/vendors/godaddy). We have not found a subprocessor list published by Cisco. We monitor 6 of its documents, which we last checked on 2026-11-11.

Cisco (cisco.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/cisco
- Documents last verified: 2026-11-11
- Transparency rating: 38/100 (how much it publishes, not how secure it is): Subprocessor list 0/30 (not found); Processing locations 0/8 (no list); Purposes 0/7 (no list); Data processing addendum 0/12 (not found); Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Companies part of it: [AppDynamics](https://thirdpartyindex.com/vendors/appdynamics), [Duo Security](https://thirdpartyindex.com/vendors/duo-security), [Splunk](https://thirdpartyindex.com/vendors/splunk)
- Supply chain: relies on 0 tracked vendors directly, 0 within two hops, 0 within three; 19 tracked vendors rely on it directly, 64 within two hops, 609 within three
- Cite as: Cisco, Third Party Index, https://thirdpartyindex.com/vendors/cisco (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://trustportal.cisco.com/c/r/ctp/trust-portal.html | 2026-11-11 | 2026-11-10 |
| Privacy policy | https://www.cisco.com/c/en/us/about/legal/privacy-full.html | 2026-11-11 | 2026-10-16 |
| Terms | https://www.cisco.com/c/en/us/about/legal/terms-conditions.html | 2026-11-11 | 2026-09-22 |
| Security page | https://www.cisco.com/site/us/en/products/security/index.html | 2026-11-11 | 2026-10-19 |
| security.txt | https://www.cisco.com/.well-known/security.txt | 2026-11-11 | 2026-09-22 |
| Status page | https://status.cisco.com/ | 2026-11-11 | 2026-11-11 |

## Subprocessors (0)

No subprocessor list has been found or read for this vendor.

## Compliance

As its trust center lists them.

- FedRAMP Marketplace: Moderate · 5 agency authorizations · since Mar 14, 2024
- FedRAMP Marketplace: Moderate · 1 agency authorization · since Dec 4, 2017
- FedRAMP Marketplace: Moderate · 6 agency authorizations · since Feb 18, 2025
- FedRAMP Marketplace: High · 3 agency authorizations · since Aug 6, 2026
- FedRAMP Marketplace: Moderate · 2 agency authorizations · since Mar 5, 2026
- FedRAMP Marketplace: Moderate · 1 agency authorization · since Nov 25, 2025
- FedRAMP Marketplace: Moderate · 40 agency authorizations · since Feb 2, 2016

## Security program

What CISCO SYSTEMS, INC.'s Form 10-K for fiscal 2026, filed Sep 2, 2026 (Item 1C) says, in its words (https://www.sec.gov/Archives/edgar/data/858877/000085887726000132/0000858877-26-000132-index.htm).

- Led by: Chief Security Officer, reporting to the Executive Vice President
- Leader's experience: 25+ years
- Board oversight: Audit Committee
- Practices named: Threat intelligence, Security training
- Engages outside assessors or consultants
- Reviews its suppliers' security
- Says no cybersecurity incident has materially affected it

## Web Technologies

Cisco's homepage made 256 requests to 30 domains, 13 services controlled by another company, and 1 domain not identified. Loaded on 2026-11-09 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

13 third parties by category: Advertising 4 (Google Cloud, Microsoft; reviewed: Samsung Ads; usually detected as Advertising: X Corp.); Marketing automation 2 (6Sense Insights, Inc., Adobe); Analytics 1 (Meta); Tag managers 1 (Tealium); Cookie compliance 1 (OneTrust); Miscellaneous 1 (reviewed: Yahoo); RUM 1 (Akamai); Surveys 1 (Qualtrics); Video players 1 (reviewed: Brightcove). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these.

### Third parties (13)

- Tealium: 30 requests to tiqcdn.com; Tealium
- Google Cloud: 26 requests to doubleclick.net, google.com, googletagmanager.com, googleadservices.com; DoubleClick Floodlight, Google Analytics, Google Tag Manager
- 6Sense Insights, Inc.: 20 requests to 6sc.co; 6sense
- Brightcove: 16 requests to brightcove.com, boltdns.net, brightcovecdn.com, brightcove.net
- OneTrust: 11 requests to cookielaw.org, onetrust.com; OneTrust
- Qualtrics: 11 requests to qualtrics.com; Qualtrics
- Adobe: 8 requests to demdex.net, marketo.net, adoberesources.net, mktoresp.com, rum.hlx.page; Marketo
- Microsoft: 6 requests to bing.com; Microsoft Advertising
- Meta: 4 requests to facebook.com, facebook.net; Facebook Pixel 2.9.438
- Akamai: 3 requests to go-mpulse.net, akstat.io; Akamai mPulse
- Samsung Ads: 1 request to adgrx.com
- X Corp.: 1 request to twitter.com
- Yahoo: 1 request to yahoo.com

### Affiliates (1)

- AppDynamics: 4 requests to appdynamics.com, eum-appdynamics.com; AppDynamics 26.4.0.4753

### Unknown (1)

Domains not identified yet: krxd.net

### First party (1)

- Cisco: 113 requests to cisco.com; AOS, Adobe Analytics, Adobe Audience Manager, Adobe Client Data Layer 2.0.2, Adobe Experience Manager, Adobe Experience Platform Identity Service, Adobe Target 1.8.3, Akamai, Boomerang, HSTS, Java, Open Graph, VideoJS 8.23.4, core-js 3.32.2, jQuery 1.12.4, lit-element 4.2.2, lit-html 3.3.3

8 tracked companies loaded by the homepage are not in Cisco's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (19)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [Alcide](https://thirdpartyindex.com/vendors/alcide.md)
- [Bluebeam](https://thirdpartyindex.com/vendors/bluebeam.md): Conferencing platform used for internal and customer meetings.
- [Certara](https://thirdpartyindex.com/vendors/certara.md): Video conferencing and online meetings (Webex) https://www.webex.com
- [ConfigCat](https://thirdpartyindex.com/vendors/configcat.md): Product analytics services
- [Contender Solutions](https://thirdpartyindex.com/vendors/contender-solutions.md): Multi-Factor Authentication
- [Epicor](https://thirdpartyindex.com/vendors/epicor.md): Global Network Provider
- [EVERSANA](https://thirdpartyindex.com/vendors/eversana.md)
- [GoDaddy](https://thirdpartyindex.com/vendors/godaddy.md): Provide and manage network solutions as part of our network; including metadata analysis.
- [Korn Ferry](https://thirdpartyindex.com/vendors/korn-ferry.md)
- [Lightedge](https://thirdpartyindex.com/vendors/lightedge.md): Data Center Infrastructure – Networking & Security
- [meetergo](https://thirdpartyindex.com/vendors/meetergo.md): Conferencing
- [NCC Group](https://thirdpartyindex.com/vendors/ncc-group.md): Managed Firewall service
- [Onit](https://thirdpartyindex.com/vendors/onit.md): If hosted on Rackspace, VPN Provider
- [Precisely Software](https://thirdpartyindex.com/vendors/precisely-software.md): Data Infrastructure
- [Presidio](https://thirdpartyindex.com/vendors/presidio.md): Multi-Factor Authentication
- [Rackspace](https://thirdpartyindex.com/vendors/rackspace.md): Data Center Infrastructure – Networking & Security
- [Rapid7](https://thirdpartyindex.com/vendors/rapid7.md)
- [Squirro](https://thirdpartyindex.com/vendors/squirro.md): Conferencing software; Provider on laptops; SaaS for Operations
- [TierPoint](https://thirdpartyindex.com/vendors/tierpoint.md): Products & Services

## Security record

CISA's Known Exploited Vulnerabilities catalog lists 103 vulnerabilities in its software:

- CVE-2026-20320 (BroadWorks), listed 2026-11-10: Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
- CVE-2026-76418 (Secure Firewall ASA Software and Cisco Secure FTD Software), listed 2026-10-29: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
- CVE-2026-76519 (Secure Email Gateway), listed 2026-10-14: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
- CVE-2026-76504 (Catalyst SD-WAN Manager), listed 2026-09-30: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
- CVE-2026-76460 (Identity Services Engine), listed 2026-09-16: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
- CVE-2026-76461 (Secure Email Gateway), listed 2026-09-14: Cisco Secure Email Gateway SQL Injection Vulnerability
- CVE-2026-20079 (Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management), listed 2026-09-09: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2026-20349 (Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)), listed 2026-08-11: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
- CVE-2026-20316 (Secure Firewall Management Center (FMC)), listed 2026-07-29: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability (known ransomware use)
- CVE-2008-4128 (IOS), listed 2026-07-13: Cisco IOS Cross-Site Request Forgery Vulnerability
- CVE-2026-20230 (Unified Communications Manager), listed 2026-06-25: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2026-20262 (Catalyst SD-WAN Manager), listed 2026-06-15: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability
- CVE-2026-20245 (Catalyst SD-WAN Manager), listed 2026-06-09: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability
- CVE-2026-20182 (Catalyst SD-WAN), listed 2026-05-14: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
- CVE-2026-20122 (Catalyst SD-WAN Manger), listed 2026-04-20: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
- CVE-2026-20128 (Catalyst SD-WAN Manager), listed 2026-04-20: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
- CVE-2026-20133 (Catalyst SD-WAN Manager), listed 2026-04-20: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
- CVE-2026-20131 (Secure Firewall Management Center (FMC)), listed 2026-03-19: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerabilit… (known ransomware use)
- CVE-2022-20775 (SD-WAN), listed 2026-02-25: Cisco SD-WAN Path Traversal Vulnerability
- CVE-2026-20127 (Catalyst SD-WAN Controller and Manager), listed 2026-02-25: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
- CVE-2026-20045 (Unified Communications Manager), listed 2026-01-21: Cisco Unified Communications Products Code Injection Vulnerability
- CVE-2025-20393 (Multiple Products), listed 2025-12-17: Cisco Multiple Products Improper Input Validation Vulnerability
- CVE-2025-20352 (IOS and IOS XE), listed 2025-09-29: Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability
- CVE-2025-20333 (Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense), listed 2025-09-25: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability
- CVE-2025-20362 (Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense), listed 2025-09-25: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability
- CVE-2025-20281 (Identity Services Engine), listed 2025-07-28: Cisco Identity Services Engine Injection Vulnerability
- CVE-2025-20337 (Identity Services Engine), listed 2025-07-28: Cisco Identity Services Engine Injection Vulnerability
- CVE-2024-20439 (Smart Licensing Utility), listed 2025-03-31: Cisco Smart Licensing Utility Static Credential Vulnerability
- CVE-2023-20118 (Small Business RV Series Routers), listed 2025-03-03: Cisco Small Business RV Series Routers Command Injection Vulnerability
- CVE-2014-2120 (Adaptive Security Appliance (ASA)), listed 2024-11-12: Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability
- CVE-2024-20481 (Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)), listed 2024-10-24: Cisco ASA and FTD Denial-of-Service Vulnerability
- CVE-2024-20399 (NX-OS), listed 2024-07-02: Cisco NX-OS Command Injection Vulnerability
- CVE-2024-20353 (Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)), listed 2024-04-24: Cisco ASA and FTD Denial of Service Vulnerability
- CVE-2024-20359 (Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)), listed 2024-04-24: Cisco ASA and FTD Privilege Escalation Vulnerability
- CVE-2020-3259 (Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)), listed 2024-02-15: Cisco ASA and FTD Information Disclosure Vulnerability (known ransomware use)
- CVE-2023-20273 (Cisco IOS XE Web UI), listed 2023-10-23: Cisco IOS XE Web UI Command Injection Vulnerability
- CVE-2023-20198 (IOS XE Web UI), listed 2023-10-16: Cisco IOS XE Web UI Privilege Escalation Vulnerability
- CVE-2023-20109 (IOS and IOS XE), listed 2023-10-10: Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability
- CVE-2023-20269 (Adaptive Security Appliance and Firepower Threat Defense), listed 2023-09-13: Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability (known ransomware use)
- CVE-2004-1464 (IOS), listed 2023-05-19: Cisco IOS Denial-of-Service Vulnerability
- CVE-2016-6415 (IOS, IOS XR, and IOS XE), listed 2023-05-19: Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability
- CVE-2017-6742 (IOS and IOS XE Software), listed 2023-04-19: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
- CVE-2020-3153 (AnyConnect Secure), listed 2022-10-24: Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability (known ransomware use)
- CVE-2020-3433 (AnyConnect Secure), listed 2022-10-24: Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability (known ransomware use)
- CVE-2019-15271 (RV Series Routers), listed 2022-06-08: Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability
- CVE-2016-6366 (Adaptive Security Appliance (ASA)), listed 2022-05-24: Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability
- CVE-2016-6367 (Adaptive Security Appliance (ASA)), listed 2022-05-24: Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
- CVE-2022-20821 (IOS XR), listed 2022-05-23: Cisco IOS XR Open Port Vulnerability
- CVE-2009-2055 (IOS XR), listed 2022-03-25: Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
- CVE-2010-3035 (IOS XR), listed 2022-03-25: Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
- CVE-2015-0666 (Prime Data Center Network Manager (DCNM)), listed 2022-03-25: Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability
- CVE-2017-3881 (IOS and IOS XE), listed 2022-03-25: Cisco IOS and IOS XE Remote Code Execution Vulnerability
- CVE-2018-0125 (VPN Routers), listed 2022-03-25: Cisco VPN Routers Remote Code Execution Vulnerability
- CVE-2018-0147 (Secure Access Control System (ACS)), listed 2022-03-25: Cisco Secure Access Control System Java Deserialization Vulnerability
- CVE-2017-12231 (IOS software), listed 2022-03-03: Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability
- CVE-2017-12232 (IOS software), listed 2022-03-03: Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability
- CVE-2017-12233 (IOS software), listed 2022-03-03: Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability
- CVE-2017-12234 (IOS software), listed 2022-03-03: Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability
- CVE-2017-12235 (IOS software), listed 2022-03-03: Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability
- CVE-2017-12237 (IOS and IOS XE Software), listed 2022-03-03: Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability
- CVE-2017-12238 (Catalyst 6800 Series Switches), listed 2022-03-03: Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability
- CVE-2017-12240 (IOS and IOS XE Software), listed 2022-03-03: Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability
- CVE-2017-12319 (IOS XE Software), listed 2022-03-03: Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability
- CVE-2017-6627 (IOS and IOS XE Software), listed 2022-03-03: Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability
- CVE-2017-6663 (IOS and IOS XE Software), listed 2022-03-03: Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability
- CVE-2017-6736 (IOS and IOS XE Software), listed 2022-03-03: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
- CVE-2017-6737 (IOS and IOS XE Software), listed 2022-03-03: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
- CVE-2017-6738 (IOS and IOS XE Software), listed 2022-03-03: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
- CVE-2017-6739 (IOS and IOS XE Software), listed 2022-03-03: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
- CVE-2017-6740 (IOS and IOS XE Software), listed 2022-03-03: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
- CVE-2017-6743 (IOS and IOS XE Software), listed 2022-03-03: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
- CVE-2017-6744 (IOS software), listed 2022-03-03: Cisco IOS Software SNMP Remote Code Execution Vulnerability
- CVE-2018-0151 (IOS and IOS XE Software), listed 2022-03-03: Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability
- CVE-2018-0154 (IOS Software), listed 2022-03-03: Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability
- CVE-2018-0155 (Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches), listed 2022-03-03: Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability
- CVE-2018-0156 (IOS Software and Cisco IOS XE Software), listed 2022-03-03: Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability
- CVE-2018-0158 (IOS Software and Cisco IOS XE Software), listed 2022-03-03: Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability
- CVE-2018-0159 (IOS Software and Cisco IOS XE Software), listed 2022-03-03: Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability
- CVE-2018-0161 (IOS Software), listed 2022-03-03: Cisco IOS Software Resource Management Errors Vulnerability
- CVE-2018-0167 (IOS, XR, and XE Software), listed 2022-03-03: Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
- CVE-2018-0172 (IOS and IOS XE Software), listed 2022-03-03: Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
- CVE-2018-0173 (IOS and IOS XE Software), listed 2022-03-03: Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
- CVE-2018-0174 (IOS XE Software), listed 2022-03-03: Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability
- CVE-2018-0175 (IOS, XR, and XE Software), listed 2022-03-03: Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
- CVE-2018-0179 (IOS Software), listed 2022-03-03: Cisco IOS Software Denial-of-Service Vulnerability
- CVE-2018-0180 (IOS Software), listed 2022-03-03: Cisco IOS Software Denial-of-Service Vulnerability
- CVE-2019-1652 (Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers), listed 2022-03-03: Cisco Small Business Routers Improper Input Validation Vulnerability
- CVE-2022-20699 (Small Business RV160, RV260, RV340, and RV345 Series Routers), listed 2022-03-03: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
- CVE-2022-20700 (Small Business RV160, RV260, RV340, and RV345 Series Routers), listed 2022-03-03: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
- CVE-2022-20701 (Small Business RV160, RV260, RV340, and RV345 Series Routers), listed 2022-03-03: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
- CVE-2022-20703 (Small Business RV160, RV260, RV340, and RV345 Series Routers), listed 2022-03-03: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
- CVE-2022-20708 (Small Business RV160, RV260, RV340, and RV345 Series Routers), listed 2022-03-03: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
- CVE-2018-0171 (IOS and IOS XE), listed 2021-11-03: Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability
- CVE-2018-0296 (Adaptive Security Appliance (ASA)), listed 2021-11-03: Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability
- CVE-2019-1653 (Small Business RV320 and RV325 Routers), listed 2021-11-03: Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
- CVE-2020-3118 (IOS XR), listed 2021-11-03: Cisco IOS XR Software Discovery Protocol Format String Vulnerability
- CVE-2020-3161 (Cisco IP Phones), listed 2021-11-03: Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability
- CVE-2020-3452 (Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)), listed 2021-11-03: Cisco ASA and FTD Read-Only Path Traversal Vulnerability
- CVE-2020-3566 (IOS XR), listed 2021-11-03: Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
- CVE-2020-3569 (IOS XR), listed 2021-11-03: Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
- CVE-2020-3580 (Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)), listed 2021-11-03: Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability (known ransomware use)
- CVE-2021-1497 (HyperFlex HX), listed 2021-11-03: Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability
- CVE-2021-1498 (HyperFlex HX), listed 2021-11-03: Cisco HyperFlex HX Data Platform Command Injection Vulnerability

## Federal contracts

U.S. government prime awards and reported subawards to its UEI (LQJKCX84CJB4, V3JJMWE4SRC6), from USAspending, by funding agency. Records show funding, not use.

| Agency | Department | Prime awards | Obligated | Subawards | Subaward total | First | Last |
|---|---|---|---|---|---|---|---|
| Department of the Army | Department of Defense | 14 | $863.8M | 266 | $75.9M | 2008-02-01 | 2025-09-17 |
| Department of the Navy | Department of Defense | 20 | $294.6M | 356 | $206.1M | 2008-01-17 | 2025-01-10 |
| Defense Information Systems Agency | Department of Defense | 21 | $436.3M | 37 | $8.1M | 2008-05-29 | 2024-12-06 |
| Department of the Air Force | Department of Defense | 22 | $273.4M | 353 | $97.0M | 2009-09-26 | 2026-07-13 |
| Defense Logistics Agency | Department of Defense | 7 | $65.7M | 41 | $8.6M | 2011-03-31 | 2021-06-21 |
| Defense Finance and Accounting Service | Department of Defense | 4 | $9.5M | 9 | $43.8M | 2013-07-26 | 2021-10-13 |
| Department of State | Department of State | 19 | $25.4M | 44 | $5.1M | 2011-07-28 | 2026-09-24 |
| Centers for Medicare and Medicaid Services | Department of Health and Human Services | — | — | 115 | $24.5M | 2015-02-02 | 2026-06-17 |
| Office of the Chief Information Officer | General Services Administration | — | — | 10 | $16.2M | 2009-11-02 | 2012-07-27 |
| National Institutes of Health | Department of Health and Human Services | — | — | 36 | $15.0M | 2010-01-21 | 2023-09-15 |
| Defense Threat Reduction Agency | Department of Defense | 5 | $8.3M | 2 | $3.2M | 2012-10-05 | 2021-06-22 |
| Immediate Office of the Secretary of Defense | Department of Defense | 16 | $9.1M | 4 | $455.9K | 2013-01-10 | 2022-05-02 |
| Defense Media Activity | Department of Defense | 5 | $5.7M | 16 | $3.8M | 2011-03-31 | 2021-07-01 |
| Office of the Chief Readiness Support Officer | Department of Homeland Security | — | — | 36 | $8.4M | 2012-06-21 | 2026-03-12 |
| Department of Education | Department of Education | 2 | $30.9K | 33 | $8.1M | 2010-03-23 | 2024-11-20 |

And 72 more agencies.
1796 records ([evidence](https://thirdpartyindex.com/evidence/248062)). Details: https://thirdpartyindex.com/vendors/cisco/federal

## Security contact

From its security.txt (https://www.cisco.com/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/4314)):

- Contact: mailto:psirt@cisco.com
- Disclosure policy: https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html
- Encryption key: https://cscrdr.cloudapps.cisco.com/cscrdr/security/center/files/Cisco_PSIRT_PGP_Public_Key.asc
- Valid until 2027-01-01
- Signed

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api