Cisco Catalyst SD-WAN Manager
Cisco's SD-WAN platform; four CVEs KEV-listed since April 2026, most of any vendor this quarter.
CISA gave US federal agencies three days, from 20 to 23 April 2026, to patch three exploited flaws in Cisco Catalyst SD-WAN Manager. A fourth, a PATH-traversal bug, joined the exploited list on 29 June.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Why did CISA give federal agencies only three days to patch Cisco SD-WAN Manager?
Timeline for Cisco Catalyst SD-WAN Manager
Became Cisco's 100th KEV entry on 30 September
Cybersecurity: Threats and Defences: Cisco reaches 100 entries on CISA's listCarried the path-traversal flaw
Cybersecurity: Threats and Defences: Cisco tops a five-vendor KEV batchMentioned in: CISA deadline for PAN-OS RCE lands four days early
Cybersecurity: Threats and DefencesCISA gives Cisco SD-WAN three days to patch
Cybersecurity: Threats and DefencesBackground
Cisco Catalyst SD-WAN Manager is the central management plane for Cisco's software-defined wide-area network (SD-WAN) products. Enterprises and governments use it to set policy for, configure and monitor connectivity across many branch sites. Because it orchestrates the whole network, a compromise could let an attacker reconfigure branch routing, Intercept traffic or move across the WAN fabric.
On 20 April 2026 CISA added three Catalyst SD-WAN Manager flaws to its Known Exploited Vulnerabilities (KEV) catalogue at once: CVE-2026-20122 (API privilege escalation), CVE-2026-20133 (sensitive information exposure) and CVE-2026-20128 (insecure password storage). Federal agencies had until 23 April to fix them, a three-day window that signals confirmed exploitation. Cisco issued patches for all three. The listing landed while Cisco's ASA and Firepower firewalls were already under scrutiny for the separate FIRESTARTER implant, so organisations running both product lines faced two remediation efforts at once.
CISA added a fourth SD-WAN Manager flaw, CVE-2026-20262, a path-traversal bug, on 29 June 2026. Cisco as a whole reached 100 KEV entries on 30 September, the second vendor to do so after Microsoft.