KEV Lag Tracker → CVE-2008-4128. Data verified against the official CISA KEV catalog and the National Vulnerability Database.
CISA added CVE-2008-4128 (Cisco IOS) to the Known Exploited Vulnerabilities catalog on July 13, 2026. It was publicly known for 6507 days before CISA confirmed active exploitation. A KEV listing is CISA’s official confirmation that a vulnerability is being exploited in the wild.
The Record
| CVE | CVE-2008-4128 |
| Vendor / product | Cisco IOS |
| Vulnerability | Cisco IOS Cross-Site Request Forgery Vulnerability |
| CVSS base score | 4.3 |
| EPSS probability the day before the KEV listing | 12.04% (95.6% percentile) |
| NVD publication date | September 18, 2008 |
| Added to CISA KEV | July 13, 2026 |
| Lag (public → KEV listing) | 6507 days |
| Federal patch deadline | July 16, 2026 |
| Known ransomware use | No |
Measured against the 1674 entries in our tracker with verified publication dates, CVE-2008-4128 was flagged faster than 0% of them.
What CISA Reported
CISA describes the flaw as follows: “Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.”
Federal Patch Deadline
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2008-4128 by July 16, 2026 — a 3-day remediation window from the KEV listing date. Private organizations are not bound by that deadline; CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
What EPSS Forecast Before the Confirmation
The EPSS forecast (FIRST’s daily estimate of the probability a CVE will be exploited within 30 days) put CVE-2008-4128 at 12.04% on the day before CISA confirmed active exploitation — the 95.6% percentile of all scored CVEs that day. That places it inside the top 10% of EPSS risk before the confirmation: this one the forecast saw coming.
| EPSS for CVE-2008-4128 | Value |
|---|---|
| Probability the day before the KEV listing | 12.04% |
| Percentile the day before the KEV listing | 95.6% |
| Probability today (August 24, 2026) | 33.68% |
| Percentile today | 98.3% |
Today’s figure is not evidence that the forecast worked: EPSS reacts to the KEV listing itself, so the score for any confirmed-exploited CVE tends to rise after CISA acts. Only the eve-of-listing number was available to a defender making the call. Across every KEV entry we track, we measured how often that number was high — see the EPSS accuracy analysis.
How This Compares to Cisco’s Track Record
At 6507 days, CVE-2008-4128 was flagged slower than Cisco’s 1245-day median across the 96 of its KEV entries with verified publication dates. Cisco currently ranks #8 on our KEV Lag leaderboard.
| Cisco in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 96 |
| Median lag (public → KEV listing) | 1245 days |
| 0-day rate (exploited at or before disclosure) | 15% |
| Entries tied to known ransomware campaigns | 6 |
Other Recent Cisco KEV Additions
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-20349 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | August 11, 2026 | 0 | No |
| CVE-2026-20316 | Secure Firewall Management Center (FMC) | July 29, 2026 | 0 | No |
| CVE-2026-20230 | Unified Communications Manager | June 25, 2026 | 22 | No |
| CVE-2026-20262 | Catalyst SD-WAN Manager | June 15, 2026 | 0 | No |
| CVE-2026-20245 | Catalyst SD-WAN Manager | June 9, 2026 | 5 | No |
Frequently Asked Questions
What is CVE-2008-4128?
CVE-2008-4128 is a vulnerability in Cisco IOS (Cisco IOS Cross-Site Request Forgery Vulnerability) that CISA added to its Known Exploited Vulnerabilities catalog on July 13, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild.
How long was CVE-2008-4128 public before CISA confirmed exploitation?
6507 calendar days, measured from its NVD publication date to the date CISA added it to the KEV catalog.
What is the federal patch deadline for CVE-2008-4128?
U.S. federal agencies must remediate CVE-2008-4128 by July 16, 2026, a 3-day window from the KEV listing date. Private organizations are not bound by that deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
Is CVE-2008-4128 used in ransomware campaigns?
CISA has not flagged CVE-2008-4128 as known to be used in ransomware campaigns. That field reflects confirmed campaign use, not the absence of risk.
What was the EPSS score for CVE-2008-4128 before it was confirmed as exploited?
12.04% — the probability EPSS assigned on the day before CISA added CVE-2008-4128 to the KEV catalog, placing it in the 95.6% percentile of all scored CVEs that day. That is inside the top 10% of EPSS risk. Its score today is higher in most cases because EPSS reacts to the KEV listing itself, so only the eve-of-listing figure reflects what a defender could have acted on.
How does this compare to other Cisco vulnerabilities?
Across 96 Cisco entries with verified publication dates, the median lag is 1245 days and 15% were exploited at or before disclosure. CVE-2008-4128, at 6507 days, is slower than that median.
Related Coverage
- Cisco’s CVE-2026-20316 Was Exploited in 0 Days — Well Under Its 1245-Day Median (July 2026)
- Cisco’s CVE-2026-20349 Was Exploited in 0 Days — Well Under Its 1245-Day Median (August 2026)
Primary Sources
- CISA Known Exploited Vulnerabilities Catalog — the official listing that confirms active exploitation, and the source of the KEV date on this page.
- NVD — CVE-2008-4128 — publication date, CVSS score and the full technical record.
- Vendor advisory — cisco.com — Cisco’s own disclosure, with the affected versions and the fix.
How We Track This
This page is generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No date or figure on this page is estimated or taken from a third-party source — they come directly from CISA and NVD records. Free to cite with attribution to CVEDaily (CC BY 4.0).