Signal
Critical Cisco vulnerabilities actively exploited including zero-day in SD-WAN Manager
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-06-24 05:44 UTCUpdated 2026-06-25 01:42 UTC
rss
cveexploitssecurity_toolingincident_responsesecurity_policy
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (4 domains)domains are deduped. counts indicate coverage, not truth.4 top sources shown
Overview
Multiple critical vulnerabilities in Cisco products, including Unified Communications Manager and Catalyst SD-WAN Manager, are being actively exploited by threat actors.
Entities
CiscoMandiantUbiquitiLantronixCisco Unified Communications ManagerCisco Catalyst SD-WAN ManagerChester SngPete Boonyakarn
Score total
1.92
Momentum 24h
8
Posts
8
Origins
7
Source types
1
Duplicate ratio
0%
Why now
- Exploitation observed weeks after patch release indicates rapid weaponization of disclosed flaws.
- Recent zero-day attacks demonstrate attackers' focus on edge devices and network management tools.
- CISA's inclusion of these vulnerabilities in its KEV catalog signals elevated threat levels to federal and private sectors.
Why it matters
- Exploitation of critical Cisco vulnerabilities risks root-level access and broad network compromise.
- Zero-day attacks on SD-WAN infrastructure threaten communications service providers' operational security.
- Active exploitation warnings from CISA highlight urgent need for patching and monitoring.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: high
Recurring claims
- Cisco Unified Communications Manager vulnerability CVE-2026-20230 is actively exploited weeks after patch release, allowing remote unauthenticated attackers to gain root access.
- A zero-day privilege escalation vulnerability CVE-2026-20245 in Cisco Catalyst SD-WAN Manager was exploited to gain root access at a communications service provider.
- CISA warns of active exploitation of critical vulnerabilities in Ubiquiti UniFi OS and Lantronix EDS5000 devices, urging timely patching.
How sources frame it
- CSO Online: neutral
- Mandiant: neutral
- CISA: neutral
All evidence
All evidence
UPDATE ALERT Cisco Catalyst SD-WAN Manager: CVSS (Max): 10.0
AusCERT - Bulletins · portal.auscert.org.au · 2026-06-25 01:42 UTC
Malicious hackers exploit Cisco zero-day for highest access level at communications service provider
CyberScoop · cyberscoop.com · 2026-06-24 18:47 UTC
CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited
thehackernews · thehackernews.com · 2026-06-24 17:19 UTC
CISA warns of max severity Ubiquiti flaws exploited in attacks
bleepingcomputer_all · bleepingcomputer.com · 2026-06-24 14:35 UTC
Attackers exploit Cisco Unified CM flaw weeks after patch release
CSO Online · csoonline.com · 2026-06-24 11:32 UTC
Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager
Mandiant Blog · cloud.google.com · 2026-06-24 11:00 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 6Origin domains: 6Duplicates: -
Showing 6 / 0
Top publishers (this list)
- AusCERT - Bulletins (1)
- CyberScoop (1)
- thehackernews (1)
- bleepingcomputer_all (1)
- CSO Online (1)
- Mandiant Blog (1)
Top origin domains (this list)
- portal.auscert.org.au (1)
- cyberscoop.com (1)
- thehackernews.com (1)
- bleepingcomputer.com (1)
- csoonline.com (1)
- cloud.google.com (1)