CISA Flags Cisco SD-WAN Flaw as Actively Exploited, Orders Agencies to Patch
Summary
CISA added Cisco Catalyst SD-WAN Manager flaw CVE-2026-20133 to its KEV catalog based on evidence of active exploitation and ordered federal agencies to secure affected systems by April 24. Cisco says it is unaware of public exploitation.
Key points
- CVE-2026-20133 is an information-disclosure flaw in Catalyst SD-WAN Manager caused by insufficient file-system access restrictions.
- Unauthenticated remote attackers may access the system API to read sensitive information from the underlying operating system.
- Cisco patched the flaw in February.
- CISA added the vulnerability to its KEV catalog based on evidence of active exploitation and set an April 24 deadline for federal civilian agencies.
- Cisco says its incident-response team is unaware of public announcements or malicious use of CVE-2026-20133.
- CISA also directs agencies to follow its SD-WAN assessment and hardening guidance, or discontinue use if mitigations are unavailable.
Article Details
- Vulnerability Types
- Information disclosure
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Discontinue use of the product if mitigations are not available.
CVE
CVE-2026-20122Cisco · Catalyst sd-wan managerOne week later, the company revealed that two other security flaws it had patched the same day (CVE-2026-20128 and CVE-2026-20122)were being exploited in the wild.CVE-2026-20127Cisco · Cisco Catalyst SD-WAN ManagerIn February, Cisco also tagged a critical authentication bypass vulnerability (CVE-2026-20127) as exploited in zero-day attacks that were enabling threat actors to add malicious rogue peers to targeted networks since atCVE-2026-20128Cisco · Catalyst sd-wan managerOne week later, the company revealed that two other security flaws it had patched the same day (CVE-2026-20128 and CVE-2026-20122)were being exploited in the wild.CVE-2026-20133Cisco · Catalyst sd-wan managerCISA has ordered federal agencies to secure Catalyst SD-WAN Manager systems within four days after adding an information-disclosure flaw (CVE-2026-20133) to its Known Exploited Vulnerabilities catalog.