CISA Flags Cisco SD‑WAN Manager Bug as Actively Exploited, Urges Immediate Mitigation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has placed a vulnerability in Cisco's Catalyst SD‑WAN Manager into its Known Exploited Vulnerabilities (KEV) catalog, signalling that the flaw is currently being leveraged by threat actors.

CISA’s KEV list is a publicly maintained register of weaknesses that have been observed in the wild. Inclusion signals a heightened risk level and prompts federal agencies, as well as private organizations, to prioritize remediation. The agency updates the catalog regularly to help defenders focus on the most pressing threats.

The vulnerability affects Cisco’s Catalyst SD‑WAN Manager, a central component used to orchestrate and monitor software‑defined wide‑area networks across enterprise environments. While the exact technical details have not been disclosed, the flaw is known to be exploitable and could enable attackers to gain unauthorized access to network controls, potentially leading to data exfiltration or service disruption.

Security Affairs first reported the issue, drawing attention to the flaw before CISA’s formal designation. The outlet’s coverage highlighted the rapid emergence of exploitation activity, prompting the agency to act swiftly in adding the bug to the KEV catalog.

Cisco’s SD‑WAN solutions are widely deployed in corporate, government, and educational networks to provide flexible, cloud‑ready connectivity. A compromise of the management layer could affect large numbers of devices, making the vulnerability especially concerning for organizations that rely on centralized policy enforcement.

CISA recommends that entities using the affected Cisco product apply any available patches, review Cisco’s security advisories, and monitor network traffic for indicators of compromise. The agency also advises broader vulnerability‑management practices, such as regular inventory of software assets and timely updates, to reduce exposure to similar threats in the future.