Cisco has recently issued an updated advisory addressing the ongoing exploitation of two additional vulnerabilities affecting its Catalyst SD-WAN solutions. This critical update highlights the active threat posed by CVE-2026-20128 and CVE-2026-20122, urging organizations leveraging Cisco Catalyst SD-WAN to take immediate action.

The announcement from Cisco underscores the dynamic nature of cybersecurity threats, particularly concerning essential network infrastructure. Software-Defined Wide Area Networking (SD-WAN) solutions like Cisco Catalyst SD-WAN are foundational for modern enterprise connectivity, providing agility, efficiency, and centralized management across geographically dispersed networks. Their critical role means that any compromise can have far-reaching implications for an organization’s operations and data security.

Understanding the New Exploited Vulnerabilities

The latest advisory from Cisco specifically brings to light the active exploitation of two previously undisclosed vulnerabilities: CVE-2026-20128 and CVE-2026-20122. These are additional to any prior security concerns, indicating an evolving threat landscape targeting Cisco Catalyst SD-WAN deployments.

• CVE-2026-20128: This vulnerability is now confirmed to be under active exploitation, posing a significant risk to affected Cisco Catalyst SD-WAN installations.
• CVE-2026-20122: Similarly, Cisco has identified active exploitation attempts targeting this vulnerability, necessitating prompt attention from network administrators.

The active exploitation status of these CVEs means that malicious actors are already leveraging these flaws in real-world scenarios. This elevates the urgency for all organizations using Cisco Catalyst SD-WAN products to review their security posture and implement recommended mitigations without delay.

Impact and Cisco’s Recommendations

The exploitation of vulnerabilities in core networking components such as SD-WAN solutions can lead to a range of detrimental outcomes. Potential impacts include unauthorized access to network resources, disruption of services, data breaches, and the establishment of persistent footholds within an enterprise network. Given the central role of SD-WAN in managing traffic and connectivity, any compromise could severely affect an organization’s entire IT infrastructure.

Cisco consistently provides detailed advisories and guidance for its customers to address security vulnerabilities. In response to the active exploitation of CVE-2026-20128 and CVE-2026-20122, organizations are strongly advised to:

• Consult the official Cisco Security Advisory for the most current and specific details regarding these vulnerabilities.
• Identify all instances of Cisco Catalyst SD-WAN within their environment.
• Immediately apply any available patches, updates, or workarounds provided by Cisco to mitigate the identified risks.
• Implement any additional security controls or configurations recommended by Cisco to harden their SD-WAN infrastructure against these specific threats.

Maintaining a Robust Cybersecurity Posture

This updated advisory serves as a crucial reminder for all organizations about the importance of proactive cybersecurity measures and rigorous patch management. Regularly monitoring vendor security advisories, promptly applying updates, and maintaining an up-to-date inventory of network devices are fundamental practices. Continuous vigilance and adherence to security best practices are essential to defend against evolving cyber threats targeting critical network infrastructure.