Cisco warns of two more SD-WAN bugs under active attack

Just when network admins thought the Cisco SD-WAN patch queue might finally be shrinking, Switchzilla has confirmed miscreants are exploiting more vulnerabilities in its SD-WAN management software. The newly abused flaws affect Cisco Catalyst SD-WAN Manager, the platform formerly known as vManage that sits at the center of many organizations' SD-WAN deployments. One of the bugs, CVE-2026-20122, carries a CVSS score of 7.1 and allows an authenticated remote attacker to overwrite arbitrary files on the local filesystem. The second issue, CVE-2026-20128, is a lower-rated information disclosure flaw with a CVSS score of 5.5 that could allow an authenticated local attacker to gain Data Collection Agent (DCA) user privileges on an affected system. In an advisory published this week, Cisco confirmed that attackers are already abusing the flaws: "In March 2026, the Cisco PSIRT became aware of active exploitation of the vulnerabilities that are described in CVE-2026-20128 and CVE-2026-20122 only." As usual with these sorts of notices, Cisco offered little detail about how the flaws are being exploited or who is behind the attacks. The company also declined to say whether the activity is linked to a cyberbaddie it warned about just days earlier. "Cisco strongly recommends that customers upgrade to a fixed software release to remediate these vulnerabilities," the company added. The warning comes barely a week after governments from the Five Eyes intelligence alliance warned that attacke...