Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities
Summary: Cisco disclosed that two vulnerabilities in Catalyst SD-WAN Manager, CVE-2026-20128 and CVE-2026-20122, have come under active exploitation in the wild, with patches released late last month alongside fixes for CVE-2026-20126, CVE-2026-20129, and CVE-2026-20133. The disclosure follows Cisco's report a week earlier that CVE-2026-20127, a CVSS 10.0 flaw in Catalyst SD-WAN Controller and Manager, was exploited by a threat actor tracked as UAT-8616 to establish persistent footholds in high-value organizations.
What you should know: watchTowr observed attack attempts from numerous unique IP addresses with web shells deployed, peaking on March 4, and its head of proactive threat intelligence Ryan Dewhurst said any exposed system should be considered compromised until proven otherwise.