Cisco warns of actively exploited Catalyst SD-WAN Manager flaws (CVE-2026-20122, CVE-2026-20128)
Cisco flags more SD-WAN flaws as actively exploited in attacks
Cisco updated an advisory to confirm active exploitation of two vulnerabilities affecting Catalyst SD-WAN Manager (formerly vManage), the centralized management plane used to administer large SD-WAN deployments. When a management plane is compromised, attackers can often pivot into the wider network and persist.
What happened (high level)
Cisco says it has observed active exploitation of:
- CVE-2026-20122 — High severity, arbitrary file overwrite; remote exploitation requires valid read-only credentials with API access.
- CVE-2026-20128 — Medium severity, information disclosure; requires valid vManage credentials on the target.
Cisco also notes these issues impact Catalyst SD-WAN Manager regardless of configuration and recommends upgrading to fixed releases.
Why it matters
Even when exploitation requires credentials, real-world compromise paths are common: credential reuse, stolen VPN creds, infostealers, leaked API keys, or low-privilege access from another foothold.
For organizations running SD-WAN at scale, the management plane is a high-value target because it can:
- change routing/policies,
- deploy configuration to many edges,
- create new peers, and
- enable broad visibility (and therefore broad data exposure) if compromised.
What to do now (practical checklist)
- Inventory Catalyst SD-WAN Manager/vManage instances (including DR/standby).
- Patch/upgrade to Cisco fixed releases as advised.
- Audit accounts with SD-WAN API access (especially read-only accounts that may still have API permissions).
- Rotate credentials associated with SD-WAN admin/API users; enforce MFA where supported.
- Review logs for unusual API activity (bulk reads, config export, unexpected file operations) around the advisory window.
- If you suspect compromise, follow an incident playbook: isolate management plane, capture artifacts, and validate controller/edge integrity.
Source
BleepingComputer — Cisco flags more SD-WAN flaws as actively exploited in attacks (March 2026): https://www.bleepingcomputer.com/news/security/cisco-flags-more-sd-wan-flaws-as-actively-exploited-in-attacks/
Note: This post is a summary for security teams. Always follow the vendor advisory for the authoritative upgrade matrix.