Maximum Severity Cisco SD-WAN Bug Exploited in the Wild

darkreading

May 14, 2026 at 8:25 PM

Actively Exploited

Overview

A serious vulnerability in Cisco's SD-WAN network control system has been actively exploited, marking the second time this year that attackers have taken advantage of a CVSS 10.0 flaw. This critical bug poses a significant risk as it allows unauthorized access to the network, potentially compromising sensitive data and systems. Organizations using Cisco SD-WAN solutions should be particularly vigilant, as the severity of this vulnerability makes it a prime target for malicious actors. It's crucial for affected users to stay informed about the latest security updates and apply any available patches to mitigate risks associated with this vulnerability.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Cisco SD-WAN network control system
Action Required: Users should apply the latest patches released by Cisco for the SD-WAN system and review their network configurations to enhance security.
Timeline: Ongoing since 2023

Original Article Summary

This is the second time this year a threat actor has leveraged a CVSS 10.0 vulnerability in Cisco's network control system.

Impact

Cisco SD-WAN network control system

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since 2023

Remediation

Users should apply the latest patches released by Cisco for the SD-WAN system and review their network configurations to enhance security. Regular monitoring for unusual activity in the network is also recommended.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Cisco, Exploit, Vulnerability, and 1 more.

Read Original Article

Related Coverage

Cisco warns of unpatched AsyncOS zero-day exploited in attacks

BleepingComputer

Cisco has issued a warning regarding a serious zero-day vulnerability in its AsyncOS software that is currently being exploited in the wild. This flaw affects Cisco's Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances, leaving customers vulnerable to potential attacks. The zero-day has been classified with maximum severity, indicating the urgency for organizations using these products to take action. As of now, there are no patches available to address this vulnerability, which raises concerns about the security of email communications for affected users. Companies that rely on these Cisco products should closely monitor their systems and implement any available security measures to mitigate risks until a fix is released.

Dec 17, 2025

China-Linked Hackers Exploiting Zero-Day in Cisco Security Gear

SecurityWeek

A new vulnerability, tracked as CVE-2025-20393, has been discovered in Cisco's Secure Email Gateway and Secure Email and Web Manager appliances. This zero-day flaw is reportedly being exploited by hackers linked to China, posing a significant risk to organizations using these products. The vulnerability allows attackers to bypass security controls, potentially leading to unauthorized access and data breaches. Companies using these Cisco appliances should prioritize patching and monitoring their systems to mitigate the risks associated with this exploit. The discovery of this flaw is particularly concerning given the ongoing cyber threats targeting critical infrastructure and enterprise environments.

Dec 18, 2025

China-linked APT UAT-9686 is targeting Cisco Secure Email Gateway and Secure Email and Web Manager

Security Affairs

Cisco has disclosed a critical zero-day vulnerability, tracked as CVE-2025-20393, affecting its Secure Email Gateway and Secure Email/Web Manager products. This vulnerability is currently being exploited by a China-linked advanced persistent threat group known as UAT-9686. The attack campaign began on December 10 and targets specific systems, raising significant concerns for organizations relying on these Cisco products. Users and administrators should be particularly vigilant, as this active exploitation could lead to unauthorized access and data breaches. The urgency of addressing this vulnerability cannot be overstated, given its potential impact on email security and the sensitive information handled by these systems.

Dec 19, 2025

Week in review: Exploited zero-day in Cisco email security appliances, Kali Linux 2025.4 released

Help Net Security

Last week, a zero-day vulnerability was discovered in Cisco email security appliances, which has been actively exploited by attackers. This flaw affects multiple versions of Cisco's email security products, putting organizations that rely on these systems at risk of data breaches and unauthorized access. Cisco has acknowledged the issue and is urging users to implement security measures while they work on a patch. The exploitation of this vulnerability raises significant concerns for businesses using Cisco's email solutions, as it could lead to serious security incidents if not addressed promptly. Users should stay vigilant and monitor for any updates from Cisco regarding remediation steps.

Dec 21, 2025

Cisco switches hit by reboot loops due to DNS client bug

BleepingComputer

Several models of Cisco switches are experiencing reboot loops triggered by fatal errors in their DNS client. This issue has been reported by users and confirmed by BleepingComputer, indicating a significant problem that could disrupt network operations for affected organizations. The models impacted include various Cisco switches, which are widely used in enterprise environments. The reboot loops not only lead to downtime but could also complicate network management and security efforts. Ensuring stable and reliable network infrastructure is crucial for businesses, making this bug a serious concern for IT departments.

Jan 8, 2026

Cisco ISE, ISE-PIC flaw patched following PoC exploit release

SCM feed for Latest

Cisco has released updates to address a medium-severity vulnerability in its Identity Services Engine (ISE) and ISE Passive Identity Connector, identified as CVE-2026-20029. This flaw was brought to light following the publication of a proof-of-concept exploit, raising concerns about its potential exploitation. Organizations using these Cisco products are at risk, as the vulnerability could allow unauthorized access or manipulation of identity services. It’s crucial for affected users to apply the updates promptly to safeguard their networks and data from possible attacks. The quick response from Cisco highlights the ongoing need for vigilance in cybersecurity practices.

Jan 9, 2026