Cisco SD-WAN Hit by Eight Exploited Vulnerabilities in 2026 — Update Immediately

If your business uses Cisco Catalyst SD-WAN — the technology that connects your branch offices and manages your wide-area network — you are looking at the most actively attacked enterprise networking product of 2026. Eight separate vulnerabilities in the Cisco Catalyst SD-WAN Controller and SD-WAN Manager have been confirmed exploited this year alone. The latest two, CVE-2026-20262 and CVE-2026-20245, were patched in mid-June after Cisco confirmed real-world exploitation. A sophisticated threat actor tracked as UAT-8616 has been operating inside some SD-WAN environments since at least 2023 — three years before public disclosure. The SD-WAN Manager can control up to 6,000 network devices from a single console, so a compromise there is a skeleton key to your entire network. Cisco has released fixed versions. The action item is simple: check your current SD-WAN software version against Cisco's patched release matrix, update, and then audit your SD-WAN Manager logs for suspicious file uploads and unauthorized configuration changes. If you are managed by an MSP or a Cisco partner, call them today and confirm this has been addressed.