CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and, together with NSA and international partners, released urgent guidance on active global exploitation of Cisco SD‑WAN systems. Notably, CISA added CVE-2026-20127 (authentication bypass) and CVE-2022-20775 (path traversal) after observed use by malicious actors for initial access, privilege escalation, and persistence; CISA issued Emergency Directive ED 26-03 requiring FCEB agencies to inventory, patch, collect artifacts, and hunt for compromise. The feed also lists numerous other KEV additions across a