Cisco SD-WAN Manager Vulnerability is Being Actively Exploited
NEOSEC enrichment — no mirror of the original source
Last week, Cisco published a security advisory warning of an authenticated privilege escalation vulnerability in Cisco Catalyst SD-WAN Manager that is being actively exploited. The flaw, CVE-2026-20245, CVSS score 7.8, is due to insufficien
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Dukes, Frost, Neely.
Linked advisories
- CVE-2026-20182May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in Febru…
- CVE-2026-20127Cisco Catalyst SD-WAN Controller and Manager — Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
- CVE-2026-20245Cisco Catalyst SD-WAN Manager: Schwachstelle ermöglicht Privilegieneskalation
- CVE-2026-20182Cisco Catalyst SD-WAN — Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Affected vendors and products
More on Actively
Other advisories
- CriticalCVE-2026-58115Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115)
- MediumCVE-2026-118539Drupal Commerce Core access bypass actively exploited (CVE-2026-118539, SA-CONTRIB-2026-254)
- MediumCVE-2024-50349Git does not sanitize URLs when asking for credentials interactively
- CriticalCVE-2025-24085Actively Exploited Vulnerability in Apple Products
- MediumCVE-2024-50349Git does not sanitize URLs when asking for credentials interactively
- Not ratedosv:CVE-2024-50349Git does not sanitize URLs when asking for credentials interactively
- CriticalCVE-2024-44309Apple Multiple Products: 2 actively exploited vulnerabilities
- CriticalCVE-2024-49039Microsoft November 2024: 2 actively exploited zero-days
Other news entries
- Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last TimeNewsThe Hacker News
- FBI, CISA warn of cyberattacks targeting refrigeration systemsNewsBleepingComputer
- Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command ExecutionNewsThe Hacker News
- The Race Against the 3-Day Clock: How Rapid7 Helps Meet BOD 26-04 ComplianceNewsRapid7
- CISA flags WordPress RCE flaw as actively exploited in attacksNewsBleepingComputer
- Over 1,000 GitLab servers vulnerable to ongoing RCE attacksNewsBleepingComputer
- Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass FlawNewsThe Hacker News
- CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEVNewsThe Hacker News
ID