Cisco Catalyst SD-WAN Manager known exploited vulnerabilities, ranked
CISA lists 5 Cisco Catalyst SD-WAN Manager CVEs as exploited in the wild. 5 were added in the last 12 months and 0 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2026-20133: EPSS 31.8%, added 2026-04-20
- CVE-2026-20262: EPSS 28.2%, added 2026-06-15
- CVE-2026-20245: EPSS 25.3%, added 2026-06-09
- CVE-2026-20128: EPSS 7.1%, added 2026-04-20
- CVE-2026-76504: EPSS 1.6%, added 2026-09-30
All 5 Cisco Catalyst SD-WAN Manager CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2026-20133 | Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor | 31.8% | – | 2026-04-20 | 2026-04-23 |
| 2 | CVE-2026-20262 | Catalyst SD-WAN Manager Directory or Path Traversal | 28.2% | – | 2026-06-15 | 2026-06-29 |
| 3 | CVE-2026-20245 | Catalyst SD-WAN Manager Improper Encoding or Escaping of Output | 25.3% | – | 2026-06-09 | 2026-06-23 |
| 4 | CVE-2026-20128 | Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format | 7.1% | – | 2026-04-20 | 2026-04-23 |
| 5 | CVE-2026-76504 | Catalyst SD-WAN Manager Hex Encoding | 1.6% | – | 2026-09-30 | 2026-10-03 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Cisco KEV CVEs · other Cisco products: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) · IOS and IOS XE Software · IOS XR · Small Business RV160, RV260, RV340, and RV345 Series Routers · IOS software · free KEV badge for Cisco · all vendors