Cisco flags ongoing exploitation of two recently patched Catalyst SD-WAN flaws

Cisco flags ongoing exploitation of two recently patched Catalyst SD-WAN flaws

Pierluigi Paganini
March 06, 2026

Cisco warns that two recently patched Catalyst SD-WAN flaws, CVE-2026-20128 and CVE-2026-20122, are already being actively exploited in the wild.

Cisco warned customers that threat actors are actively exploiting two recently patched Catalyst SD-WAN vulnerabilities, CVE-2026-20128 and CVE-2026-20122. The networking giant urged organizations to apply the latest security updates to reduce the risk of compromise.

“Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an attacker to access an affected system, elevate privileges to root, gain access to sensitive information, and overwrite arbitrary files.” reads the advisory published by CISCO.

Cisco released security patches on February 25 for five Catalyst SD-WAN vulnerabilities, including fixes for…