What happened
Cisco dropped the news you’ve probably already guessed from the last round of vendor webinars and fear-checked risk reports: two Catalyst SD-WAN Manager vulnerabilities are actively being exploited in the wild. CVE-2026-20128 and CVE-2026-20122. Patches exist, presumably, but if your plan was to patch on a calm Tuesday after you finish the quarterly budget review, you’re now staring at a fire extinguisher with a label that says “burns nicely.” The attackers don’t wait for your change control window to close; they pounce while you’re debating whether the patch is worth the test in prod. This is not irony, it’s reality, and it comes with a glass of whiskey in hand.
Why this is not just a vendor problem
What you should actually do
First, apply the Cisco patch now. Then verify that the patch is actually deployed across the SD-WAN Manager fleet and not just visible in a ticketing system. Isolate management networks, restrict internet access to those devices, and implement strong access controls so a single stolen credential can’t jump from the data center into the patch window. Review logs for indicators of compromise that resemble the exploitation pattern and hunt those signals like you’re chasing a payday. Validate backups and test restoration in a controlled lab, because in production you don’t want to discover you can’t roll back when the next patch breaks three differently configured devices. Add multi-factor authentication on management interfaces, tighten ACLs, and keep monitoring steady as a heartbeat. If you’re tempted to believe this is just another vendor patch, pour yourself a glass of whiskey and acknowledge the reality — you’re still fighting yesterday’s battles with today’s patches.
Beyond the immediate fix, map the dependency chain to understand which other devices and services could be affected by a patch cascade. The SD-WAN space is a web of interconnected appliances, and a single misconfiguration can ripple through your network faster than a rumor at a conference after-hours. The goal isn’t a perfect patch fence; it’s a resilient, observable, and well-tested environment where attackers have nowhere to stand.
Read the original article here: Cisco warns of more Catalyst SD-WAN flaws exploited in the wild
