CISA Adds Eight Exploited Vulnerabilities to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency added eight vulnerabilities to its Known Exploited Vulnerabilities catalog on Monday, flagging them as actively exploited in real-world attacks and requiring federal civilian executive branch agencies to apply mitigations by early May.

Among the additions are three flaws in Cisco's Catalyst SD-WAN Manager software, a platform used to monitor and manage up to 6,000 network devices from a single dashboard. The most recent, CVE-2026-20133, is a high-severity information disclosure vulnerability patched by Cisco in late February. It stems from insufficient file system access restrictions, allowing unauthenticated remote attackers to access the system's API and read sensitive information on the underlying operating system. Cisco described the issue in its advisory, stating that a successful exploit could enable attackers to obtain such data. While Cisco's team has not confirmed active exploitation of this specific flaw, the agency based its catalog inclusion on evidence of attacks in the wild.

The other two Cisco vulnerabilities, CVE-2026-20128 and CVE-2026-20122, were also patched in February and confirmed by Cisco as...