Cisco IOS XE Web UI Privilege Escalation Vulnerability

What it is

Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.

Who's affected

Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.

What to do

Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.

If you don't have someone in-house to verify the patch deployed across every endpoint — or you're not sure whether you're affected — that's exactly the kind of triage we do. Book a free 20-minute triage call.

CISA due date

CISA's listed due date: October 20, 2023.

Federal civilian agencies work under CISA's Binding Operational Directive 26-04, which replaced BOD 22-01 on June 10, 2026. It sets the deadline for each affected system by:

• How exposed that system is to the internet
• Whether the attack can be automated
• How much control it gives an attacker

Its table gives catalogued vulnerabilities 3 or 14 days.

None of this binds a private business, but treat the date as a strong recommendation, especially if you handle regulated data (HIPAA, GLBA, ABA model rules).

EPSS

EPSS score: 99.6% — higher than 100% of all scored CVEs.

EPSS estimates the probability of exploitation activity in the next 30 days. Every entry on this site is already confirmed exploited, so read it as relative urgency among the things you still have open, not as permission to wait.

Score dated 2026-09-26, from the FIRST.org Exploit Prediction Scoring System.

Browse more

• All Cisco KEV entries
• Firewalls & edge
• All SMB-relevant KEV entries

Source

This entry comes from CISA's Known Exploited Vulnerabilities catalog, public US-Government data we pull daily. The plain-language framing and the what-to-do guidance above are ours. View the original entry on cisa.gov.