The U.S. Cybersecurity and Infrastructure Security Agency (CISA) listed three Cisco Catalyst SD-WAN Manager bugs as under exploit and setting a deadline to fix the issue.

Two of the exploited flaws, CVE-2026-20128 and CVE-2026-20122, were confirmed as actively exploited by Cisco in early March 2026.

CVE-2026-20128 is a bug in the data collection agent (DCA) feature of Cisco Catalyst SD-WAN Manager, which could allow an authenticated, local attacker to gain DCA user privileges on an affected system. CVE-2026-20122 affects the solution’s API, allowing remote attackers to overwrite arbitrary files on the affected system and gain vManage user privileges if exploited.

It’s currently unclear whether the third and newest flaw, CVE-2026-20133, was exploited alongside the previous two in those initial attacks or if it is an entirely new vulnerability. It works as another information disclosure bug that allows unauthenticated, remote attackers to view sensitive information on affected systems.

CISA added all three to its Known Exploited Vulnerabilities Catalog on April 20, requiring the company to address them by April 23. The agency explained that “these types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise."

Although the Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities only applies to federal civilian executive branch agencies, CISA “strongly urged all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice."

Previous Cisco vulnerabilities

The news follows another recent cybersecurity development when countries across the Five Eyes alliance flagged Cisco SD-WAN controllers as under threat from an attack campaign focusing on federal networks.

Cisco's Talos security research unit revealed the threat, highlighting a vulnerability in Cisco Catalyst SD-WAN Controller that enables an unauthenticated remote attacker to gain administrative privileges on the affected system by sending a specially crafted request that bypasses authentication.

Upon successful exploitation, the attacker obtains administrative privileges on the controller by accessing it as an internal, high-privilege, non-root user account.

Tracked as CVE-2026-20127, Talos associated the remote control execution (RCE) threat with hacking group UAT-8616, with exploitation dating back to 2023. Researchers did not specifically align UAT-8616 with any particular nation-states in its advisory blog.

Last October, the network giant saw pressure from the U.S. government over another RCE-based exploit, this one in its firewall offerings that may have allowed for a nation state-backed breach. The threat saw U.S. Senator Bill Cassidy (R-Louisiana) demand Cisco CEO Chuck Robbins identify any specific threats to individual customers, alongside details of its communication plan with customers, including federal agencies.