---
id: "CVE-2016-6415"
kind: "vulnerability"
aliases: ["CVE-2016-6415"]
title: "The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR\u2026"
severity: "high"
cvss: 7.5
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Cisco IOS, IOS XR, and IOS XE", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": ">= 12.2, <= 12.4", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": ">= 15.0, <= 15.6", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "<= 3.18s", "ecosystem": "vendor"}, {"name": "cisco ios xr", "fixed": [], "affected": ">= 4.3.0, <= 4.3.4", "ecosystem": "vendor"}, {"name": "cisco ios xr", "fixed": ["5.3.0"], "affected": ">= 5.0.0, < 5.3.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisco", "exploited", "infrastructure", "ios", "ios-xe", "ios-xr", "routers", "vpn"]
not_affected_if: ["ikev1-disabled", "non-cisco-hardware"]
published_at: "2016-09-19T01:59:06+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-6415", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6415", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR…

Cisco IOS, IOS XR and IOS XE contain an IKEv1 flaw in how security negotiation requests are handled, letting an attacker read device memory. The disclosed memory can expose sensitive data held by the router, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco IOS, IOS XR, and IOS XE affected ? fixed ?
- vendor:cisco ios affected >= 12.2, <= 12.4 fixed ?
- vendor:cisco ios affected >= 15.0, <= 15.6 fixed ?
- vendor:cisco ios xe affected <= 3.18s fixed ?
- vendor:cisco ios xr affected >= 4.3.0, <= 4.3.4 fixed ?
- vendor:cisco ios xr affected >= 5.0.0, < 5.3.0 fixed 5.3.0

## How to check

Run 'show version' on each Cisco IOS, IOS XR or IOS XE device and compare against the fixed releases in Cisco's advisory.
Check whether IKEv1 is enabled, for example with 'show crypto isakmp policy' or 'show crypto isakmp sa'.

## Fix

Apply the Cisco software update for your platform per vendor instructions, as CISA requires.
If IKEv1 is not needed, disabling it is the mitigation the sources imply but do not detail: unknown.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-6415
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-6415

## From the sources

Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_