Cisco released security updates for a critical vulnerability in Catalyst SD-WAN Manager (CVE-2026-20262) that attackers exploited to gain root-level access to affected systems.
Cisco has addressed CVE-2026-20262, a vulnerability in the Catalyst SD-WAN Manager that was actively exploited in zero-day attacks. The flaw allows attackers to escalate privileges to root level, granting complete control over affected devices.
The company released patches across multiple software versions to remediate the issue. Cisco recommends organizations immediately apply updates to their SD-WAN deployments to prevent unauthorized access.
SD-WAN Manager is a critical component in Cisco's SD-WAN architecture, responsible for managing and orchestrating branch office connections. A compromise at this level poses significant risk to enterprise network infrastructure, as attackers could potentially redirect traffic, access sensitive data, or deploy additional malware.
The zero-day nature of the vulnerability means attackers were exploiting it before Cisco and the security community became aware of the flaw. The company has not disclosed specific attack details but confirmed active exploitation occurred prior to patch availability.
Organizations running affected versions should prioritize applying the security updates. Cisco's advisory includes version numbers for all impacted releases and provides guidance on deploying patches with minimal network disruption.
This incident underscores the importance of maintaining current patch levels in network infrastructure, particularly for devices handling critical traffic routing and management functions. SD-WAN deployments have become increasingly common as enterprises modernize wide-area networks, making such management platforms attractive targets for sophisticated threat actors.
Cisco continues to monitor for additional exploitation attempts and will provide updates if new information emerges regarding the vulnerability or attacks.
Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.
A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.
A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.
Security researchers scanning Polish government websites discovered critical vulnerabilities that could expose courts, hospitals, and airports to cyberattacks. The vulnerabilities stem from common software used to manage and display web content.