Under Attack: Cisco Urges Immediate Action as Hackers Actively Exploit SD-WAN Manager Flaws

Cisco warns that two vulnerabilities in the Catalyst SD‑WAN Manager are being actively exploited: CVE‑2026‑20122 allows an authenticated attacker with read‑only API access to overwrite arbitrary files and escalate to vmanage privileges, and CVE‑2026‑20128 exposes plaintext DCA credentials enabling lateral movement; Cisco provides fixed releases and strongly recommends immediate upgrades.