Skip to content
OriginalSign in

CISA

CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list

Part of the CVE-2026-20262 story · since 15 Jun

Quiet for 19 weekslast report 16 Jun9 articles4 outlets
15 Jun · SecurityOnline first23 Aug15 Sep8 OctNowThis article3rd of 9
  • Mon 15 Jun, 18:09 UTC. SecurityOnline, first report. Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 19:41 UTC. CISA, its first report on the story. CISA adds Cisco SDWAN Manager CVE-2026-20262 to KEV list. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:17 UTC. CISA. CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list. Cites a CVE in CISA KEV. This article, 3rd of 9.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 06:30 UTC. SecurityWeek, its first report on the story. Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 11:30 UTC. Security Affairs. Cisco SD WAN manager flaw lets attackers write files, patch urged. Cites a CVE in CISA KEV.

The Known Exploited Vulnerabilities (KEV) Catalog, maintained by CISA, serves as a comprehensive resource for identifying vulnerabilities that are actively exploited. The catalog aids organizations in prioritizing vulnerabilities based on risk, enhancing their cybersecurity management. Users can nominate new vulnerabilities for inclusion and access the catalog in various formats including CSV and JSON.

A specific vulnerability, CVE-2026-20262, affecting Cisco Catalyst SD-WAN Manager, has been highlighted, allowing file manipulation by remote attackers. This entry includes recommendations for mitigation based on CISA's guidelines for security updates. The catalog also allows users to subscribe for updates on newly identified vulnerabilities.

How the story developed

All 9 articles
Quiet for 19 weekslast report 16 Jun9 articles4 outlets

9 articles from 4 outlets since 15 Jun. Quiet since 16 Jun. This was the 3rd report, 2 hours after the first.

Now15 Jun16171829 OctFirst reportSecurityOnline · 15 Jun, 18:09
  • Mon 15 Jun, 18:09 UTC. SecurityOnline, first report. Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 19:41 UTC. CISA, its first report on the story. CISA adds Cisco SDWAN Manager CVE-2026-20262 to KEV list. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:17 UTC. CISA. CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list. Cites a CVE in CISA KEV. This article, 3rd of 9.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 06:30 UTC. SecurityWeek, its first report on the story. Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 11:30 UTC. Security Affairs. Cisco SD WAN manager flaw lets attackers write files, patch urged. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Mon 15 JunDay 03
    1. Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now18:09 · SecurityOnline · First report · Known exploited CVE
    2. CISA adds Cisco SDWAN Manager CVE-2026-20262 to KEV list19:41 · CISA · official · CISA alert · Known exploited CVE
    3. CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list20:17 · CISA · official · Known exploited CVE · This article, 3rd of 9
  2. Tue 16 JunDay 16
    1. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed01:30 · SecurityOnline · Known exploited CVE
    2. Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks06:30 · SecurityWeek · Known exploited CVE
    3. Inside the Stealthy Agent Tesla Infection Chain08:21 · SecurityOnline · Known exploited CVE
    Show 3 more from 16 Jun
    1. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack09:29 · Security Affairs · Known exploited CVE
    2. Could Apple Build Its Own OpenClaw Competitor?09:30 · SecurityOnline · Known exploited CVE
    3. Cisco SD WAN manager flaw lets attackers write files, patch urged11:30 · Security Affairs · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in