pwn.watch: SD-WAN incident updates

[critical] Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks

Thu, 22 Oct 2026 19:32:20 GMT

Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.

Status: live · Patch: patched · Fixed in: 5.2.3.18, 6.1.3.10, 6.4.2.12

Latest updates:

2026-10-22: Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator, with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched. Arista advised restricting the VCO web interface to admin networks, blocking 74.82.197.86 and 38.54.50.151, and preserving logs before remediating if compromise is suspected. (source)

CVEs: CVE-2026-114625

[high] Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Wed, 30 Sep 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. Added to CISA KEV on 2026-09-30.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-30: CISA added CVE-2026-76504 to the KEV catalog (due 2026-10-03).

CVEs: CVE-2026-76504

[high] Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

Mon, 15 Jun 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. Added to CISA KEV on 2026-06-15.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-06-15: CISA added CVE-2026-20262 to the KEV catalog (due 2026-06-29).

CVEs: CVE-2026-20262

[high] Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

Tue, 09 Jun 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. Added to CISA KEV on 2026-06-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-06-09: CISA added CVE-2026-20245 to the KEV catalog (due 2026-06-23).

CVEs: CVE-2026-20245

[high] Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Thu, 14 May 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. Added to CISA KEV on 2026-05-14.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-05-14: CISA added CVE-2026-20182 to the KEV catalog (due 2026-05-17).

CVEs: CVE-2026-20182

[high] Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Mon, 20 Apr 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems. CISA added CVE-2026-20133, CVE-2026-20128 to the Known Exploited Vulnerabilities catalog on 2026-04-20 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-04-20: CISA added CVE-2026-20133, CVE-2026-20128 to the KEV catalog (due 2026-04-23).

CVEs: CVE-2026-20133, CVE-2026-20128

[high] Cisco Catalyst SD-WAN Manger: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Mon, 20 Apr 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges. Added to CISA KEV on 2026-04-20.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-04-20: CISA added CVE-2026-20122 to the KEV catalog (due 2026-04-23).

CVEs: CVE-2026-20122

[critical] Cisco Catalyst SD-WAN zero-day campaign (CISA emergency directive)

Sat, 28 Feb 2026 00:00:00 GMT

In February 2026 CISA issued an emergency directive after exploitation of critical authentication-bypass and related flaws in Cisco Catalyst SD-WAN Manager/controllers. Cisco Talos said related activity dated back years; unauthenticated attackers could gain administrative privileges on exposed controllers.

Status: closed · Patch: patched · Fixed in: Cisco fixed releases per advisory

[high] Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

Wed, 25 Feb 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration f

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-02-25: CISA added CVE-2026-20127 to the KEV catalog (due 2026-02-27).

CVEs: CVE-2026-20127