Incident · Resolved
Cisco Catalyst SD-WAN Attacks
Cisco Catalyst SD-WAN · 2 stories since FEB 26
- 2
- stories
- 5
- CVEs
- APR 22
- latest
The story so far
In February 2026, Cisco and the NSA warned that a previously unknown flaw in the Catalyst SD-WAN Controller, CVE-2026-20127, had been exploited since at least 2023 by an actor Talos calls UAT-8616, which then gained root through an older bug. In April, CISA added three more Catalyst SD-WAN vulnerabilities to its Known Exploited list, including CVE-2026-20133, which hadn’t been seen in attacks before.
Written by the editors