U.S. CISA adds Cisco SD-WAN flaws to its Known Exploited Vulnerabilities catalog

CISA added two critical Cisco Catalyst SD-WAN flaws (CVE-2026-20127 — CVSS 10.0 authentication bypass — and CVE-2022-20775 — CLI privilege escalation) to its Known Exploited Vulnerabilities catalog after Cisco and Cisco Talos observed active exploitation since 2023 by a highly sophisticated actor tracked as UAT-8616; the attacker reportedly used a software downgrade plus the privilege-escalation bug to gain persistent root/admin access and manipulate SD‑WAN configurations. Cisco published patched releases and recommended immediate upgrades, log reviews for suspicious 'Accepted publickey for vmanage-admin' entries, and temporary port restrictions while urging customers to remediate vulnerable deployments.