CVE-2023-20198Vulnerability
Cisco IOS XE Web UI Privilege Escalation Vulnerability
Reported by 3 independent sources · first reported by GreyNoise · last reported
Last reported 29 days ago
Fix due 20 Oct 2023
Used by ransomware: not knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
What the reports say
5 reports, newest first · the exact sentence from each-
Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions“…ypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained with the CVE-2023-20198 authentication bypass to achieve root-level code execution.”
-
June 2026 CVE Landscape“CVE-2023-20198”
-
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs“CVE-2023-20198 – Cisco IOS XE Web UI Privilege Escalation”
-
GreyNoise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks“GreyNoise has observed active exploitation of CVE-2023-20198, with 110 malicious IPs actively targeting vulnerable Cisco devices, primarily from Bulgaria, Brazil, and Singapore.”
-
U.S. and UK Warn of Russian Cyber Threats: 9 of 12 GreyNoise-Tracked Vulnerabilities in the Advisory Are Being Probed Right Now“CVE-2023-20198 — Cisco IOS XE Web UI Privilege Escalation”
Indicators reported together
named in the same reportsAlso named with it: CVE-2022-27925, CVE-2021-26855, CVE-2024-21762, CVE-2022-41082, CVE-2024-3400, CVE-2023-4966, CVE-2023-20273, CVE-2023-42793, CVE-2023-29357, CVE-2026-25089, CVE-2026-39808, CVE-2026-11645, CVE-2026-28318, CVE-2026-20230, CVE-2026-35616, CVE-2026-33825, CVE-2025-55182, CVE-2026-21509, CVE-2025-8088, CVE-2017-11882
Thanks — we review every report.