CISA Alerts Defenders to Exploited Cisco Catalyst SD-WAN Manager Security Flaws

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning to network defenders regarding the active exploitation of Cisco Catalyst SD-WAN Manager.

On April 20, 2026, CISA officially added three distinct security flaws affecting the platform to its Known Exploited Vulnerabilities (KEV) catalog.

Cisco Catalyst SD-WAN Manager is a critical administrative console used to configure and maintain enterprise-wide area network infrastructure.

Because this platform controls vital network traffic routing, compromising it gives attackers a dangerous foothold in corporate environments.

Federal agencies and private organizations are required to implement immediate mitigations by a strict deadline of April 23, 2026.

Three Exploited Cisco Vulnerabilities

• CVE-2026-20133 exposes sensitive information to unauthorized actors, allowing remote attackers to view confidential network data.
• CVE-2026-20122 involves the misuse of privileged APIs due to improper file handling, allowing attackers to overwrite system files and gain powerful vManage privileges.
• CVE-2026-20128 stems from storing passwords in a recoverable format, which lets a low-privileged local attacker grab credential files and escalate to DCA user privileges.

The combination of these vulnerabilities poses a significant threat to overall network integrity.

Attackers can potentially start by gathering sensitive data remotely and then exploit API weaknesses to modify critical system files.

Once they achieve vManage or DCA user privileges, threat actors essentially have total control over the SD-WAN management environment.

While CISA has confirmed active exploitation in the wild, it is currently unknown if ransomware gangs have incorporated these specific flaws into their attack playbooks.

Regardless, the extremely tight three-day remediation window highlights the severity of the threat.

Network administrators must act rapidly to secure their infrastructure against these ongoing attacks.

Organisations are instructed to closely follow CISA’s Emergency Directive 26-03 to assess their exposure and properly patch vulnerable systems.

Security teams should also thoroughly review the official Hunt and Hardening Guidance for Cisco SD-WAN Devices to detect potential breaches and secure their configurations.

If the platform is hosted in the cloud, defenders must adhere to the binding operational directive BOD 22-01.

CISA explicitly warns that if organizations cannot apply these mitigations promptly, they must discontinue the use of the affected product entirely to protect their networks.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.