Cisco Warns of Active Exploitation of Two Catalyst SD-WAN Flaws
Summary
Cisco says two patched Catalyst SD-WAN flaws, CVE-2026-20128 and CVE-2026-20122, are being exploited. It has not shared attack details; the advisory suggests the flaws may be chained with others.
Key points
- Cisco updated its advisory on March 5 to report active exploitation of CVE-2026-20128 and CVE-2026-20122.
- CVE-2026-20128 affects the Data Collection Agent feature of Catalyst SD-WAN Manager; an authenticated local attacker can gain DCA user privileges.
- CVE-2026-20122 affects the Catalyst SD-WAN Manager API and lets a remote authenticated attacker overwrite arbitrary files and gain elevated privileges.
- Cisco has not disclosed details of attacks involving these two flaws; its descriptions indicate they may be chained with other vulnerabilities.
- A separate Catalyst SD-WAN zero-day, CVE-2026-20127, was reported exploited in the wild and can allow remote authentication bypass and admin access.
- CISA and other agencies reported CVE-2026-20127 being chained with CVE-2022-20775 to bypass authentication, escalate privileges, and establish persistence. Talos linked those attacks to UAT-8616.
Article Details
- Vulnerability Types
- Information disclosure
- Arbitrary file overwrite
- Authentication bypass
- Severity
- CVE-2026-20127 is described as critical; individual severity ratings for CVE-2026-20128 and CVE-2026-20122 are not specified.
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2022-20775Cisco · Cisco Catalyst SD-WAN; Cisco · Cisco Catalyst SD-WAN Manager; +3 moreagencies reported that CVE-2026-20127 has been chained with an older Catalyst vulnerability, CVE-2022-20775, to bypass authentication, escalate privileges, and establish persistence on the targeted system.CVE-2026-20122Cisco · Catalyst sd-wan managerCisco updated its advisory on March 5 to warn that it has become aware of active exploitation for two of the five vulnerabilities: CVE-2026-20128 and CVE-2026-20122.CVE-2026-20127Cisco · Cisco Catalyst SD-WAN ManagerTracked as CVE-2026-20127, that security hole can be exploited remotely to bypass authentication and obtain admin privileges on a vulnerable device.CVE-2026-20128Cisco · Catalyst sd-wan managerCisco updated its advisory on March 5 to warn that it has become aware of active exploitation for two of the five vulnerabilities: CVE-2026-20128 and CVE-2026-20122.