Active Exploitation of Arista EOS, Chromium V8, and Cisco SD‑WAN Manager (CVE‑2026‑7473, CVE‑2026‑11645, CVE‑2026‑20245) Triggers Urgent Remediation
What It Is — The Cybersecurity and Infrastructure Security Agency (CISA) has added three CVEs to its Known Exploited Vulnerabilities (KEV) Catalog, confirming that threat actors are actively exploiting these flaws in Arista’s Extensible Operating System (EOS), Google Chromium’s V8 engine, and Cisco’s Catalyst SD‑WAN Manager.
Exploitability — All three vulnerabilities are confirmed to be exploited in the wild. CVE‑2026‑7473 enables bypass of comparison logic in EOS, CVE‑2026‑11645 allows out‑of‑bounds read/write in V8, and CVE‑2026‑20245 leads to improper output encoding in Cisco’s SD‑WAN manager. CVSS scores range from 8.8 to 9.8 (Critical).
Affected Products —
- Arista Networks – Extensible Operating System (EOS) – CVE‑2026‑7473
- Google – Chromium browser V8 JavaScript engine – CVE‑2026‑11645
- Cisco Systems – Catalyst SD‑WAN Manager – CVE‑2026‑20245
TPRM Impact — These flaws affect core networking and application platforms used by many third‑party vendors. Compromise can lead to lateral movement across supply‑chain environments, unauthorized data access, and service disruption for downstream customers.
Recommended Actions —
- Prioritize patching of EOS, Chromium, and Cisco SD‑WAN Manager according to vendor advisories.
- Verify that all third‑party services in your ecosystem have applied the patches; request proof of remediation from suppliers.
- Update vulnerability‑management policies to treat KEV‑listed CVEs as “high‑priority” items with a 14‑day remediation window.
- Conduct targeted penetration testing on any remaining unpatched instances to confirm exploit mitigation.
- Document remediation status for compliance with CISA’s Binding Operational Directive 22‑01.
Source: CISA Advisory – CISA Adds Three Known Exploited Vulnerabilities to Catalog