Cisco warns additional SD-WAN Manager flaws are actively exploited

Photo by BleepingComputer on BleepingComputer

What happened

Cisco says two additional Catalyst SD-WAN Manager vulnerabilities are now being actively exploited in attacks:

• CVE-2026-20122 (high): arbitrary file overwrite
• CVE-2026-20128 (medium): information disclosure

This follows earlier disclosure of exploitation tied to CVE-2026-20127, an authentication bypass issue affecting SD-WAN deployments.

Exploitation context

Catalyst SD-WAN Manager (formerly vManage) is a centralized control platform for large SD-WAN environments. Successful compromise can expose sensitive network-management functions and increase attacker reach inside enterprise networks.

According to updated reporting, exploitation activity has targeted real-world deployments, and government agencies have already issued urgent remediation direction related to SD-WAN risk.

Immediate actions for defenders

1. Upgrade to fixed Cisco software releases without delay.
2. Inventory internet-exposed SD-WAN management interfaces and limit access.
3. Review authentication and API exposure, especially read-only accounts with API rights.
4. Collect and retain forensic artifacts from SD-WAN controllers.
5. Hunt for rogue peer/device indicators and unusual controller changes.

Bottom line

SD-WAN management infrastructure is now a repeatedly exploited target area. Treat this as an active intrusion risk and prioritize patching plus compromise assessment, not just routine vulnerability management.