# SD-WAN security incidents · pwn.watch

> Security incidents tagged SD-WAN (vendor, product, platform or attack type).

Page: https://pwn.watch/t/sd-wan · generated 2026-10-22T21:47:37.879Z

## Status (as of 2026-10-22)
- Incidents: 9 (1 live, 0 live and not fully patched, 9 patched)
- Days without a SD-WAN security incident: 0
- Newest incident started: 2026-10-22

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/sd-wan.json
- RSS (one item per incident, bumped on each update): https://pwn.watch/t/sd-wan/feed.xml
- This file: https://pwn.watch/t/sd-wan/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks](https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625) ([json](https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625.json)): critical, live, patched, started 2026-10-22, CVE-2026-114625
- [Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504.json)): high, closed, patched, started 2026-09-30, CVE-2026-76504
- [Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20262) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20262.json)): high, closed, patched, started 2026-06-15, CVE-2026-20262
- [Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20245) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20245.json)): high, closed, patched, started 2026-06-09, CVE-2026-20245
- [Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182.json)): high, closed, patched, started 2026-05-14, CVE-2026-20182
- [Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20133) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20133.json)): high, closed, patched, started 2026-04-20, CVE-2026-20133, CVE-2026-20128
- [Cisco Catalyst SD-WAN Manger: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manger-cve-2026-20122) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-manger-cve-2026-20122.json)): high, closed, patched, started 2026-04-20, CVE-2026-20122
- [Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127.json)): high, closed, patched, started 2026-02-25, CVE-2026-20127
- [Cisco Catalyst SD-WAN zero-day campaign (CISA emergency directive)](https://pwn.watch/i/cisco-sdwan-february-2026-emergency-directive) ([json](https://pwn.watch/i/cisco-sdwan-february-2026-emergency-directive.json)): critical, closed, patched, started 2026-02-01