CISA Alerts Defenders to Exploited Cisco Catalyst SD

Gbhackers •Divya • April 21, 2026

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning to network defenders regarding the active exploitation of Cisco Catalyst SD-WAN Manager. On April 20, 2026, CISA officially added three distinct security flaws affecting the platform to its Known Exploited Vulnerabilities (KEV) catalog. Cisco Catalyst SD-WAN Manager is a critical administrative console used […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Warns of Active Exploitation of Cisco Catalyst SD-WAN Vulnerabilities The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding the active exploitation of three vulnerabilities in Cisco's Catalyst SD-WAN Manager, specifically CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133. These vulnerabilities were added to CISA's Known Exploited Vulnerabilities (KEV) catalog on April 20, 2026, with a tight remediation deadline set for April 23, 2026. The flaws allow attackers to gain unauthorized access to sensitive information and potentially take control of affected systems. Cisco has yet to confirm the active exploitation of CVE-2026-20133, although CISA has indicated evidence of exploitation. Organizations must implement mitigations immediately, or discontinue use of the affected product. CISA's Emergency Directive 26-03 outlines the necessary steps for federal agencies and private organizations to secure their networks. The vulnerabilities pose significant risks to network integrity, especially given the critical role of the Catalyst SD-WAN Manager in managing enterprise-wide area network infrastructure. 16 sources 72

Extracted Entities

Platforms (1)

Cisco Catalyst Sd-wan Manager