Cisco flags more SD-WAN flaws as actively exploited in attacks

Cisco warned that multiple Catalyst SD-WAN Manager vulnerabilities are being actively exploited, including a high-severity arbitrary file overwrite (CVE-2026-20122) and a medium-severity information disclosure flaw (CVE-2026-20128), and reiterated that a separate critical authentication bypass (CVE-2026-20127) has been exploited since at least 2023; the flaws allow attackers to compromise controllers, insert rogue peers, and move deeper into networks, prompting vendor patches and a U.S. CISA emergency directive for mitigation.