Critical Exploitation of Cisco Catalyst SD‑WAN Manager (CVE‑2026‑20128 & CVE‑2026‑20122) Threatens Enterprise Networks
What It Is – Cisco disclosed that two recently patched vulnerabilities in its Catalyst SD‑WAN Manager (formerly vManage) are being actively exploited in the wild. The flaws allow authenticated attackers to gain privileged access, elevate to root, and overwrite arbitrary files via the SD‑WAN API.
Exploitability – Active exploitation confirmed by Cisco PSIRT; proof‑of‑concept details not publicly released. Both CVEs have been assigned CVSS scores in the high‑to‑critical range (≥8.0).
Affected Products – Cisco Catalyst SD‑WAN Manager (vManage) and associated Data Collection Agent feature.
TPRM Impact – Organizations that rely on Cisco SD‑WAN as a managed networking service face supply‑chain risk: compromised gateways can expose internal traffic, enable lateral movement, and jeopardize downstream customers’ data.
Recommended Actions –
- Deploy Cisco’s February 25, 2026 patches for CVE‑2026‑20128, CVE‑2026‑20122, and related SD‑WAN advisories immediately.
- Verify firmware versions across all SD‑WAN edge devices and controllers.
- Enable strict API authentication and audit logs for anomalous activity.
- Segment SD‑WAN management interfaces from corporate networks.
- Conduct a rapid risk assessment of any third‑party services that consume SD‑WAN connectivity.
Source: Security Affairs – Cisco flags ongoing exploitation of two recently patched Catalyst SD‑WAN flaws