CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA published multiple alerts adding numerous vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and released joint guidance (with NSA and international partners) on active, global exploitation of Cisco SD‑WAN systems. Notably, CISA added CVE-2026-20127 (authentication bypass) and CVE-2022-20775 (path traversal) after observing actors using the former for initial access and the latter for privilege escalation and persistence. CISA issued Emergency Directive ED 26‑03 requiring Federal Civilian Executive Branch agencies to inventory, collect artifacts, patch, and hunt for SD‑W