Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities
2026-03-06T07:24:10Z•88594fdccf0d88c7f61df2da8f5bff36dce785617cee434254539452dabf57c1
APTCISA KEVChrome WebViewCisco Catalyst SD‑WAN ManagerMFA bypassOAuth redirect abusePackagistQualcomm/AndroidRATSD‑WANVMware Aria Operationsactive exploitationiOS exploit kitphishingsupply‑chain malware
What happened
Multiple high-impact security developments: Cisco confirmed active exploitation of two Catalyst SD‑WAN Manager flaws including CVE-2026-20122 (arbitrary file overwrite). CISA added VMware Aria Operations command‑injection CVE-2026-22719 to its KEV catalog. Google reported exploitation of Qualcomm Android Graphics bug CVE-2026-21385, and Google patched Chrome WebView privilege-escalation CVE-2026-0628. Concurrently, researchers observed diverse active campaigns (APT activity—Silver Dragon, APT28, Dust Specter; phishing suites like Starkiller and Tycoon 2FA; supply‑chain/package malware on Packa
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 88594fdccf0d88c7f61df2da8f5bff36dce785617cee434254539452dabf57c1
- Enrichment time
- 2026-03-06T07:24:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.