cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Cisco Warns Two More SD-WAN Flaws Are Actively Exploited

· Original article ↗

Summary

Cisco says attackers are actively exploiting two Catalyst SD-WAN Manager flaws: an arbitrary file overwrite requiring read-only API credentials and an information disclosure requiring local vManage credentials. Cisco urges customers to upgrade.

Key points

  • Cisco says it became aware of active exploitation of CVE-2026-20122 and CVE-2026-20128 in March 2026.
  • CVE-2026-20122 is a high-severity arbitrary file overwrite exploitable remotely with valid read-only API credentials.
  • CVE-2026-20128 is a medium-severity information disclosure requiring valid local vManage credentials.
  • Cisco says both flaws affect Catalyst SD-WAN Manager regardless of device configuration and recommends upgrading to fixed releases.
  • A separate flaw, CVE-2026-20127, has reportedly been exploited since at least 2023 to compromise controllers and add rogue peers.
  • CISA Emergency Directive 26-03 requires federal agencies to inventory Cisco SD-WAN systems, apply updates, and investigate potential compromises.
  • Cisco also released updates for Secure Firewall Management Center flaws CVE-2026-20079 and CVE-2026-20131.

Article Details

Vulnerability Types
  • Arbitrary file overwrite
  • Information disclosure
Severity
High for CVE-2026-20122; medium for CVE-2026-20128.
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2022-20775Cisco · Cisco Catalyst SD-WAN; Cisco · Cisco Catalyst SD-WAN Manager; +3 morepotential compromises tied to attacks targeting CVE-2026-20127 and an older flaw tracked as CVE-2022-20775.CVE-2026-20079Cisco · Cisco Secure Firewall Management Center (FMC)Related SD-WAN zero-days (notably CVE-2026-20127) have been exploited since 2023, prompting CISA Emergency Directive 26-03; Cisco also patched critical FMC flaws CVE-2026-20079 and CVE-2026-20131.CVE-2026-20122Cisco · Catalyst sd-wan managerCisco warns that two additional Catalyst SD-WAN Manager vulnerabilities (CVE-2026-20122 and CVE-2026-20128) are being actively exploited in the wild and urges administrators to upgrade vulnerable devices.CVE-2026-20127Cisco · Cisco Catalyst SD-WAN ManagerCatalyst SD-WAN Manager regardless of configuration and follow earlier zero-day compromises like CVE-2026-20127.CVE-2026-20128Cisco · Catalyst sd-wan managerCisco warns that two additional Catalyst SD-WAN Manager vulnerabilities (CVE-2026-20122 and CVE-2026-20128) are being actively exploited in the wild and urges administrators to upgrade vulnerable devices.CVE-2026-20131Cisco · Cisco Secure Firewall Management Center (FMC)Related SD-WAN zero-days (notably CVE-2026-20127) have been exploited since 2023, prompting CISA Emergency Directive 26-03; Cisco also patched critical FMC flaws CVE-2026-20079 and CVE-2026-20131.

Vendors

CiscoCisco warns that two additional Catalyst SD-WAN Manager vulnerabilities (CVE-2026-20122 and CVE-2026-20128) are being actively exploited in the wild and urges administrators to upgrade vulnerable devices.

Products

Cisco Catalyst SD-WAN ManagerCisco warns that two additional Catalyst SD-WAN Manager vulnerabilities (CVE-2026-20122 and CVE-2026-20128) are being actively exploited in the wild and urges administrators to upgrade vulnerable devices.Secure Firewall Management Center (FMC)More recently, on Wednesday, Cisco released security updates to patch two maximum-severity vulnerabilities in its Secure Firewall Management Center (FMC) software.

Countries

United StatesAfter joint advisories by U.S. and U.K.

Related Articles