Skip to content
Sign in

Cisco product

SD-WAN

Alert
No CISA KEV deadline is open. CISA last added a SD-WAN CVE on 25 Feb.

Tracked since 25 Feb · latest article 8 Mar · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 1 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date1

SD-WAN CVEs in CISA KEV with their federal deadlines. None is open.

Exploited SD-WAN CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2022-20775SD-WAN25 FebPassed 27 Feb11
Vendor CSV of 101 entries for CiscoAll 101 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds SD-WAN CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’251Q1 ’260Q2 ’260Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20261
Q2 20260
Q3 20260
Q4 20260

Fix listed

1 of 1 CVE in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2022-20775: 96.2th percentile, in CISA KEV050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2022-2077596.2

Coverage11 articles · all time

The latest 11 articles naming SD-WAN, in the shared story grammar.

Full timeline
Quiet for 33 weekslast report 8 Mar11 articles7 outlets

11 articles from 7 outlets since 25 Feb. Quiet since 8 Mar.

Now25 Feb271 Mar357911First reportCISA · 25 Feb, 17:31Picked up againafter 7 days quiet
  • Wed 25 Feb, 17:31 UTC. CISA, first report. CISA lists Cisco SD WAN flaw allowing root access, CVE-2022-20775. Cites a CVE in CISA KEV.
  • Wed 25 Feb, 17:33 UTC. CISA. CISA adds Cisco SD WAN CVE-2022-20775 to KEV, warns of root risk. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 00:45 UTC. Rapid7, its first report on the story. CISA orders emergency patch for Cisco SD WAN after CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 06:49 UTC. The Hacker News, its first report on the story. Critical CVE-2026-20127 in Cisco SD WAN gives remote admin access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:52 UTC. SecurityWeek, its first report on the story. Cisco patches exploited Catalyst SD WAN zero day CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:53 UTC. Infosecurity, its first report on the story. Five Eyes warn Cisco SD WAN zero day grants admin CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 12:56 UTC. Security Affairs, its first report on the story. CVE-2026-20127: Critical Cisco SD WAN flaw gives root access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 16:01 UTC. Security Affairs. CISA: CVE-2026-20127 lets attackers gain admin on Cisco SD WAN. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 22:10 UTC. Dark Reading, its first report on the story. Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 12:29 UTC. SecurityWeek. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns. Cites a CVE in CISA KEV.
  • Sun 8 Mar, 12:49 UTC. SecurityWeek. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 11 articles as a list
  1. Wed 25 FebDay 02
    1. CISA lists Cisco SD WAN flaw allowing root access, CVE-2022-2077517:31 · CISA · official · First report · CISA alert · Known exploited CVE
    2. CISA adds Cisco SD WAN CVE-2022-20775 to KEV, warns of root risk17:33 · CISA · official · Known exploited CVE
  2. Thu 26 FebDay 17
    1. CISA orders emergency patch for Cisco SD WAN after CVE-2026-2012700:45 · Rapid7 · Known exploited CVE
    2. Critical CVE-2026-20127 in Cisco SD WAN gives remote admin access06:49 · The Hacker News · Known exploited CVE
    3. Cisco patches exploited Catalyst SD WAN zero day CVE-2026-2012709:52 · SecurityWeek · Known exploited CVE
    Show 4 more from 26 Feb
    1. Five Eyes warn Cisco SD WAN zero day grants admin CVE-2026-2012709:53 · Infosecurity · Known exploited CVE
    2. CVE-2026-20127: Critical Cisco SD WAN flaw gives root access12:56 · Security Affairs · Known exploited CVE
    3. CISA: CVE-2026-20127 lets attackers gain admin on Cisco SD WAN16:01 · Security Affairs · Known exploited CVE
    4. Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years22:10 · Dark Reading · Known exploited CVE

  3. Quiet for 7 days

    Thu 5 MarDay 81
    1. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns12:29 · SecurityWeek · Picked up again · Known exploited CVE

  4. Quiet for 3 days

    Sun 8 MarDay 111
    1. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks12:49 · SecurityWeek · Picked up again · Known exploited CVE

All CVEs in coverage1

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2022-20775Exploited

    Cisco SD-WAN Path Traversal Vulnerability

    7.8High12% EPSS · 11 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in