Cisco’s latest vulnerability spree has a more troubling pattern underneath

Cisco has disclosed multiple vulnerabilities in SD-WAN and firewall products, with researchers confirming active exploitation of several CVEs (including long-running zero-days). Amazon Threat Intelligence linked Interlock ransomware to exploitation of CVE-2026-20131, and other groups have been observed exploiting SD-WAN defects; the incidents threaten network-edge management, enabling wide access, persistent compromise, and significant operational impact, prompting vendor advisories and CISA involvement.