{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:10:46.198Z",
  "tag": {
    "id": "sd-wan",
    "label": "SD-WAN",
    "isStack": false,
    "url": "https://pwn.watch/t/sd-wan",
    "feed": "https://pwn.watch/t/sd-wan/feed.xml"
  },
  "counts": {
    "incidents": 9,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 9
  },
  "incidents": [
    {
      "slug": "arista-velocloud-orchestrator-cve-2026-114625",
      "title": "Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks",
      "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625",
      "json": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Arista VeloCloud Orchestrator (VCO) On-Prem",
      "tags": [
        "arista",
        "velocloud",
        "sd-wan",
        "sql-injection",
        "zero-day",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2026-114625"
      ],
      "affectedVersions": [
        "VCO 5.2.x before 5.2.3.18",
        "VCO 6.1.x before 6.1.3.10",
        "VCO 6.4.x before 6.4.2.12"
      ],
      "fixedVersions": [
        "5.2.3.18",
        "6.1.3.10",
        "6.4.2.12"
      ],
      "startedAt": "2026-10-22",
      "closedAt": null,
      "updatedAt": "2026-10-22T20:32:13+02:00",
      "summary": "Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.",
      "xPost": {
        "id": "2113331616257077699",
        "postedAt": "2026-10-22T18:08:16.065Z",
        "url": "https://x.com/pwnwatch_app/status/2113331616257077699"
      }
    },
    {
      "slug": "cisco-catalyst-sd-wan-manager-cve-2026-76504",
      "title": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504",
      "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN Manager",
      "tags": [
        "cisco",
        "sd-wan",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-76504"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-30",
      "closedAt": "2026-09-30",
      "updatedAt": "2026-09-30",
      "summary": "Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. Added to CISA KEV on 2026-09-30.",
      "xPost": null
    },
    {
      "slug": "cisco-catalyst-sd-wan-manager-cve-2026-20262",
      "title": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20262",
      "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20262.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN Manager",
      "tags": [
        "cisco",
        "sd-wan",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-20262"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-06-15",
      "closedAt": "2026-06-15",
      "updatedAt": "2026-06-15",
      "summary": "Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. Added to CISA KEV on 2026-06-15.",
      "xPost": null
    },
    {
      "slug": "cisco-catalyst-sd-wan-manager-cve-2026-20245",
      "title": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20245",
      "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20245.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN Manager",
      "tags": [
        "cisco",
        "sd-wan",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-20245"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-06-09",
      "closedAt": "2026-06-09",
      "updatedAt": "2026-06-09",
      "summary": "Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. Added to CISA KEV on 2026-06-09.",
      "xPost": null
    },
    {
      "slug": "cisco-catalyst-sd-wan-cve-2026-20182",
      "title": "Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182",
      "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN",
      "tags": [
        "cisco",
        "sd-wan",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2026-20182"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-05-14",
      "closedAt": "2026-05-14",
      "updatedAt": "2026-05-14",
      "summary": "Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. Added to CISA KEV on 2026-05-14.",
      "xPost": null
    },
    {
      "slug": "cisco-catalyst-sd-wan-manager-cve-2026-20133",
      "title": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20133",
      "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20133.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN Manager",
      "tags": [
        "cisco",
        "sd-wan",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-20133",
        "CVE-2026-20128"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-04-20",
      "closedAt": "2026-04-20",
      "updatedAt": "2026-04-20",
      "summary": "Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems. CISA added CVE-2026-20133, CVE-2026-20128 to the Known Exploited Vulnerabilities catalog on 2026-04-20 based on evidence of active exploitation.",
      "xPost": null
    },
    {
      "slug": "cisco-catalyst-sd-wan-manger-cve-2026-20122",
      "title": "Cisco Catalyst SD-WAN Manger: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manger-cve-2026-20122",
      "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-manger-cve-2026-20122.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN Manger",
      "tags": [
        "cisco",
        "sd-wan",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-20122"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-04-20",
      "closedAt": "2026-04-20",
      "updatedAt": "2026-04-20",
      "summary": "Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges. Added to CISA KEV on 2026-04-20.",
      "xPost": null
    },
    {
      "slug": "cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127",
      "title": "Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127",
      "json": "https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN Controller and Manager",
      "tags": [
        "cisco",
        "sd-wan",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2026-20127"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-02-25",
      "closedAt": "2026-02-25",
      "updatedAt": "2026-02-25",
      "summary": "Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration f",
      "xPost": null
    },
    {
      "slug": "cisco-sdwan-february-2026-emergency-directive",
      "title": "Cisco Catalyst SD-WAN zero-day campaign (CISA emergency directive)",
      "url": "https://pwn.watch/i/cisco-sdwan-february-2026-emergency-directive",
      "json": "https://pwn.watch/i/cisco-sdwan-february-2026-emergency-directive.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Cisco Catalyst SD-WAN Manager / controllers",
      "tags": [
        "cisco",
        "sd-wan",
        "zero-day"
      ],
      "cveIds": [],
      "affectedVersions": [
        "See Cisco Security Advisories and CISA emergency directive"
      ],
      "fixedVersions": [
        "Cisco fixed releases per advisory"
      ],
      "startedAt": "2026-02-01",
      "closedAt": "2026-02-28",
      "updatedAt": "2026-02-28",
      "summary": "In February 2026 CISA issued an emergency directive after exploitation of critical authentication-bypass and related flaws in Cisco Catalyst SD-WAN Manager/controllers. Cisco Talos said related activity dated back years; unauthenticated attackers could gain administrative privileges on exposed controllers.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Dark Web Informer",
      "handle": "DarkWebInformer",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2109088203504287744/BJcETLaO_bigger.jpg",
      "text": "🚨 Critical Arista VeloCloud Orchestrator SQL injection flaw actively exploited\n\nArista has disclosed CVE-2026-114625, a critical vulnerability affecting on-premises VeloCloud Orchestrator deployments.\n⠀\nThe SQL injection flaw allows any authenticated user, including someone https://t.co/YmvPfvAwhb",
      "date": "2026-10-22T15:33:25.000Z",
      "url": "https://x.com/DarkWebInformer/status/2113292650828726321",
      "media": [],
      "incident": "arista-velocloud-orchestrator-cve-2026-114625"
    }
  ],
  "changes": [
    {
      "incident": "arista-velocloud-orchestrator-cve-2026-114625",
      "incidentTitle": "Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator, with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched. Arista advised restricting the VCO web interface to admin networks, blocking 74.82.197.86 and 38.54.50.151, and preserving logs before remediating if compromise is suspected.",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/",
      "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625"
    },
    {
      "incident": "cisco-catalyst-sd-wan-manager-cve-2026-76504",
      "incidentTitle": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-30",
      "title": "CISA added CVE-2026-76504 to the KEV catalog (due 2026-10-03).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504"
    },
    {
      "incident": "cisco-catalyst-sd-wan-manager-cve-2026-20262",
      "incidentTitle": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-06-15",
      "title": "CISA added CVE-2026-20262 to the KEV catalog (due 2026-06-29).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20262"
    },
    {
      "incident": "cisco-catalyst-sd-wan-manager-cve-2026-20245",
      "incidentTitle": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-06-09",
      "title": "CISA added CVE-2026-20245 to the KEV catalog (due 2026-06-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20245"
    },
    {
      "incident": "cisco-catalyst-sd-wan-cve-2026-20182",
      "incidentTitle": "Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-05-14",
      "title": "CISA added CVE-2026-20182 to the KEV catalog (due 2026-05-17).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182"
    },
    {
      "incident": "cisco-catalyst-sd-wan-manager-cve-2026-20133",
      "incidentTitle": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-04-20",
      "title": "CISA added CVE-2026-20133, CVE-2026-20128 to the KEV catalog (due 2026-04-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20133"
    },
    {
      "incident": "cisco-catalyst-sd-wan-manger-cve-2026-20122",
      "incidentTitle": "Cisco Catalyst SD-WAN Manger: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-04-20",
      "title": "CISA added CVE-2026-20122 to the KEV catalog (due 2026-04-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manger-cve-2026-20122"
    },
    {
      "incident": "cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127",
      "incidentTitle": "Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-02-25",
      "title": "CISA added CVE-2026-20127 to the KEV catalog (due 2026-02-27).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127"
    }
  ]
}