Skip to content
Sign in

Cisco product

Catalyst SD-WAN Manager

Alert
No CISA KEV deadline is open. CISA last added a Catalyst SD-WAN Manager CVE on 30 Sep.

Tracked since 5 Mar · latest article 5 Oct · RSS · API

0Open KEV deadlines

None open

1Added to KEV · 90 days

of 5 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date5

Catalyst SD-WAN Manager CVEs in CISA KEV with their federal deadlines. None is open.

Exploited Catalyst SD-WAN Manager CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2026-76504Catalyst SD-WAN Manager30 SepPassed 3 Oct10
In CISA KEVCVE-2026-20262Catalyst SD-WAN Manager15 JunPassed 29 Jun9
In CISA KEVCVE-2026-20245Catalyst SD-WAN Manager9 JunPassed 23 Jun17
In CISA KEVCVE-2026-20128Catalyst SD-WAN Manager20 AprPassed 23 Apr8
In CISA KEVCVE-2026-20133Catalyst SD-WAN Manager20 AprPassed 23 Apr5
Vendor CSV of 101 entries for CiscoAll 101 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds Catalyst SD-WAN Manager CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’250Q1 ’264Q2 ’261Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20264
Q3 20261
Q4 20260

Fix listed

3 of 5 CVEs in coverage

2 CVEs have no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-76504: 98.6th percentile, in CISA KEVCVE-2026-20133: 98.3th percentile, in CISA KEVCVE-2026-20262: 98.2th percentile, in CISA KEVCVE-2026-20245: 97.9th percentile, in CISA KEVCVE-2026-20128: 94.4th percentile, in CISA KEV050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-7650498.6
CVE-2026-2013398.3
CVE-2026-2026298.2
CVE-2026-2024597.9
CVE-2026-2012894.4

Coverage48 articles · all time

The latest 48 articles naming Catalyst SD-WAN Manager, in the shared story grammar.

Full timeline
Quiet for 3 weekslast report 5 Oct48 articles10 outlets

48 articles from 10 outlets since 5 Mar. Quiet since 5 Oct.

Now5 Mar2651425514254132428 Sep15First reportSecurityWeek · 5 Mar, 12:29CISA alert21 Apr, 00:22 · official
  • Thu 5 Mar, 12:29 UTC. SecurityWeek, first report. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 16:41 UTC. The Hacker News, its first report on the story. Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 10:58 UTC. SOCRadar, its first report on the story. Cisco Catalyst SD-WAN Manager (CVE-2026-20122 & CVE-2026-20128) Flaws Exploited. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 15:36 UTC. Security Affairs, its first report on the story. Cisco warns SDWAN flaws CVE-2026-20128 CVE-2026-20122. Cites a CVE in CISA KEV.
  • Sun 8 Mar, 12:49 UTC. SecurityWeek. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks. Cites a CVE in CISA KEV.
  • Fri 13 Mar, 20:15 UTC. Dark Reading, its first report on the story. Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos. Cites a CVE in CISA KEV.
  • Tue 21 Apr, 00:22 UTC. CISA, its first report on the story. Cisco SDWAN flaw leaks data, CISA orders patch by April 2026. Cites a CVE in CISA KEV.
  • Tue 21 Apr, 00:32 UTC. CISA. CISA Adds CVE-2026-20128 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Tue 21 Apr, 00:58 UTC. CISA. Cisco SD-WAN flaw leaks data, CISA urges urgent patching. Cites a CVE in CISA KEV.
  • Tue 21 Apr, 00:58 UTC. CISA. Cisco SD-WAN Manager bug exposes passwords to local attackers. Cites a CVE in CISA KEV.
  • Tue 21 Apr, 10:21 UTC. Security Affairs. CISA adds weaponised PaperCut, TeamCity flaws to KEV catalog. Cites a CVE in CISA KEV.
  • Tue 21 Apr, 11:31 UTC. SecurityWeek. CISA Adds Cisco SD WAN, Zimbra XSS Flaws to KEV Catalog. Cites a CVE in CISA KEV.
  • Fri 5 Jun, 02:20 UTC. SecurityOnline, its first report on the story. Cisco SD-WAN CVE-2026-20245 flaw lets hackers gain root via file upload. Cites a CVE in CISA KEV.
  • Fri 5 Jun, 06:15 UTC. SecurityWeek. Cisco SDWAN flaw lets attackers gain root via CLI exploit. Cites a CVE in CISA KEV.
  • Fri 5 Jun, 14:41 UTC. Security Affairs. Cisco SD-WAN Has a New Root-Level Problem, and There’s No Fix Yet. Cites a CVE in CISA KEV.
  • Sat 6 Jun, 06:07 UTC. The Hacker News. Critical Cisco SDWAN flaw CVE-2026-20245 exploited, no patch. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 19:14 UTC. CISA. CISA Adds Cisco SD WAN Manager Flaw to KEV Following Active Exploit. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 20:13 UTC. CISA. CISA Adds Cisco SD WAN Manager Flaw to KEV Following Active Exploit. Cites a CVE in CISA KEV.
  • Wed 10 Jun, 02:40 UTC. SecurityOnline. CISA warns of critical flaws in Chromium, Arista and Cisco gear. Cites a CVE in CISA KEV.
  • Wed 10 Jun, 09:10 UTC. SecurityOnline. Architectural Exposure: Developers Extract Apple’s Subterranean Core Prompts for Siri AI. Cites a CVE in CISA KEV.
  • Wed 10 Jun, 09:11 UTC. SecurityOnline. Havoc Stager Uses Fake Invoices to Hit South American Firms. Cites a CVE in CISA KEV.
  • Wed 10 Jun, 11:28 UTC. Security Affairs. CISA flags Arista, Chrome, Cisco flaws; patch by June 23. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 18:09 UTC. SecurityOnline. Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 19:41 UTC. CISA. CISA adds Cisco SDWAN Manager CVE-2026-20262 to KEV list. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:17 UTC. CISA. CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 06:30 UTC. SecurityWeek. Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:29 UTC. Security Affairs. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 11:30 UTC. Security Affairs. Cisco SD WAN manager flaw lets attackers write files, patch urged. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 14:42 UTC. Google Cloud, its first report on the story. Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 21:50 UTC. Dark Reading. Cisco Catalyst SD WAN bug exploited pre patch, gave root access. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 06:30 UTC. SecurityWeek. Cisco SDWAN flaw lets attackers run root commands, Mandiant warns. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 06:31 UTC. The Hacker News. CVE-2026-20245 exposes Cisco Catalyst SD WAN zero day flaw. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 10:11 UTC. Security Affairs. Cisco Catalyst SDWAN zero day exploited months before fix. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 14:21 UTC. Infosecurity, its first report on the story. Google warns Cisco flaw exploited months before June 2026 patch. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 15:38 UTC. The Hacker News. Cisco Warns of Active Exploitation in Critical SD-WAN Flaw. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 17:32 UTC. CISA. CISA Warns of Active Exploitation in Cisco SD-WAN Manager Flaw. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 18:38 UTC. SecurityOnline. Cisco Patches Exploited SD-WAN Flaw Enabling Unauthenticated Admin Access. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 18:38 UTC. Rapid7, its first report on the story. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 08:38 UTC. SecurityWeek. Cisco Patches Actively Exploited SD-WAN Manager Auth Bypass. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 09:51 UTC. Security Affairs. CISA Flags Actively Exploited Cisco SD-WAN Authentication Flaw. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 11:31 UTC. The Hacker News. Cisco SD-WAN Flaw Exploited to Bypass Authentication as Admin. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 13:01 UTC. SOCRadar. Actively Exploited Cisco SD-WAN Flaw Grants Unauthenticated Admin Access. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 14:52 UTC. Infosecurity. Cisco SD-WAN Zero Day Exposes Internet Facing Systems to Attackers. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 04:06 UTC. SecurityOnline. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 48 articles as a list
  1. Thu 5 MarDay 02
    1. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns12:29 · SecurityWeek · First report · Exploited CVE · Known exploited CVE
    2. Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN16:41 · The Hacker News · Known exploited CVE
  2. Fri 6 MarDay 12
    1. Cisco Catalyst SD-WAN Manager (CVE-2026-20122 & CVE-2026-20128) Flaws Exploited10:58 · SOCRadar · Known exploited CVE
    2. Cisco warns SDWAN flaws CVE-2026-20128 CVE-2026-2012215:36 · Security Affairs · Known exploited CVE

  3. Quiet for 2 days

    Sun 8 MarDay 31
    1. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks12:49 · SecurityWeek · Known exploited CVE

  4. Quiet for 5 days

    Fri 13 MarDay 81
    1. Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos20:15 · Dark Reading · Picked up again · Known exploited CVE

  5. Quiet for 5 weeks

    Tue 21 AprDay 476
    1. Cisco SDWAN flaw leaks data, CISA orders patch by April 202600:22 · CISA · official · CISA alert · Picked up again · Known exploited CVE
    2. CISA Adds CVE-2026-20128 to Known Exploited Vulnerabilities Catalogue00:32 · CISA · official · Known exploited CVE
    3. Cisco SD-WAN flaw leaks data, CISA urges urgent patching00:58 · CISA · official · Known exploited CVE
    Show 3 more from 21 Apr
    1. Cisco SD-WAN Manager bug exposes passwords to local attackers00:58 · CISA · official · Known exploited CVE
    2. CISA adds weaponised PaperCut, TeamCity flaws to KEV catalog10:21 · Security Affairs · Known exploited CVE
    3. CISA Adds Cisco SD WAN, Zimbra XSS Flaws to KEV Catalog11:31 · SecurityWeek · Known exploited CVE

  6. Quiet for 6 weeks

    Fri 5 JunDay 923
    1. Cisco SD-WAN CVE-2026-20245 flaw lets hackers gain root via file upload02:20 · SecurityOnline · Picked up again · Known exploited CVE
    2. Cisco SDWAN flaw lets attackers gain root via CLI exploit06:15 · SecurityWeek · Known exploited CVE
    3. Cisco SD-WAN Has a New Root-Level Problem, and There’s No Fix Yet14:41 · Security Affairs · Known exploited CVE
  7. Sat 6 JunDay 931
    1. Critical Cisco SDWAN flaw CVE-2026-20245 exploited, no patch06:07 · The Hacker News · Known exploited CVE

  8. Quiet for 4 days

    Tue 9 JunDay 962
    1. CISA Adds Cisco SD WAN Manager Flaw to KEV Following Active Exploit19:14 · CISA · official · Picked up again · Known exploited CVE
    2. CISA Adds Cisco SD WAN Manager Flaw to KEV Following Active Exploit20:13 · CISA · official · Known exploited CVE
  9. Wed 10 JunDay 974
    1. CISA warns of critical flaws in Chromium, Arista and Cisco gear02:40 · SecurityOnline · Known exploited CVE
    2. Architectural Exposure: Developers Extract Apple’s Subterranean Core Prompts for Siri AI09:10 · SecurityOnline · Known exploited CVE
    3. Havoc Stager Uses Fake Invoices to Hit South American Firms09:11 · SecurityOnline · Known exploited CVE
    4. CISA flags Arista, Chrome, Cisco flaws; patch by June 2311:28 · Security Affairs · Known exploited CVE

  10. Quiet for 5 days

    Mon 15 JunDay 1023
    1. Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now18:09 · SecurityOnline · Picked up again · Known exploited CVE
    2. CISA adds Cisco SDWAN Manager CVE-2026-20262 to KEV list19:41 · CISA · official · Known exploited CVE
    3. CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list20:17 · CISA · official · Known exploited CVE
  11. Tue 16 JunDay 1036
    1. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed01:30 · SecurityOnline · Known exploited CVE
    2. Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks06:30 · SecurityWeek · Known exploited CVE
    3. Inside the Stealthy Agent Tesla Infection Chain08:21 · SecurityOnline · Known exploited CVE
    Show 3 more from 16 Jun
    1. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack09:29 · Security Affairs · Known exploited CVE
    2. Could Apple Build Its Own OpenClaw Competitor?09:30 · SecurityOnline · Known exploited CVE
    3. Cisco SD WAN manager flaw lets attackers write files, patch urged11:30 · Security Affairs · Known exploited CVE

  12. Quiet for 8 days

    Wed 24 JunDay 1112
    1. Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager14:42 · Google Cloud · Picked up again · Known exploited CVE
    2. Cisco Catalyst SD WAN bug exploited pre patch, gave root access21:50 · Dark Reading · Known exploited CVE
  13. Thu 25 JunDay 1124
    1. Cisco SDWAN flaw lets attackers run root commands, Mandiant warns06:30 · SecurityWeek · Known exploited CVE
    2. CVE-2026-20245 exposes Cisco Catalyst SD WAN zero day flaw06:31 · The Hacker News · Known exploited CVE
    3. Cisco Catalyst SDWAN zero day exploited months before fix10:11 · Security Affairs · Known exploited CVE
    4. Google warns Cisco flaw exploited months before June 2026 patch14:21 · Infosecurity · Known exploited CVE
  14. Fri 26 JunDay 1131
    1. Cisco SD-WAN Zero-Day Exploited in Attacks14:21 · SecurityOnline · Known exploited CVE

  15. Quiet for 14 weeks

    Wed 30 SepDay 2094
    1. Cisco Warns of Active Exploitation in Critical SD-WAN Flaw15:38 · The Hacker News · Picked up again · Known exploited CVE
    2. CISA Warns of Active Exploitation in Cisco SD-WAN Manager Flaw17:32 · CISA · official · Known exploited CVE
    3. Cisco Patches Exploited SD-WAN Flaw Enabling Unauthenticated Admin Access18:38 · SecurityOnline · Known exploited CVE
    4. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access18:38 · Rapid7 · Known exploited CVE
  16. Thu 1 OctDay 2105
    1. Cisco Patches Actively Exploited SD-WAN Manager Auth Bypass08:38 · SecurityWeek · Known exploited CVE
    2. CISA Flags Actively Exploited Cisco SD-WAN Authentication Flaw09:51 · Security Affairs · Known exploited CVE
    3. Cisco SD-WAN Flaw Exploited to Bypass Authentication as Admin11:31 · The Hacker News · Known exploited CVE
    Show 2 more from 1 Oct
    1. Actively Exploited Cisco SD-WAN Flaw Grants Unauthenticated Admin Access13:01 · SOCRadar · Known exploited CVE
    2. Cisco SD-WAN Zero Day Exposes Internet Facing Systems to Attackers14:52 · Infosecurity · Known exploited CVE

  17. Quiet for 4 days

    Mon 5 OctDay 2141
    1. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk04:06 · SecurityOnline · Picked up again · Known exploited CVE

All CVEs in coverage5

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-76504Exploited

    Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

    9.8Critical39% EPSS · 10 articles
  • CVE-2026-20133Exploited

    Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

    6.5Medium31% EPSS · 5 articles
  • CVE-2026-20262Exploited

    Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

    6.5Medium29% EPSS · 9 articles
  • CVE-2026-20245Exploited

    Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

    7.8High25% EPSS · 17 articles
  • CVE-2026-20128Exploited

    Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

    7.5High7.3% EPSS · 8 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in