CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws

CISA issued Emergency Directive 26-03 warning of active exploitation of CVE-2026-20127 — a critical (CVSS 10) authentication bypass in Cisco Catalyst SD‑WAN — and ordered federal agencies to identify affected systems, store and submit logs and forensic artifacts to CISA’s Cloud Logging Aggregation Warehouse, apply vendor patches, hunt for evidence of compromise, rebuild systems if root access is found, and report remediation by set deadlines as investigators work to determine the scope of exploitation.