CISA Gave Federal Agencies Four Days to Patch Cisco SD-WAN. You Should Do the Same.
CISA dropped eight CVEs into the Known Exploited Vulnerabilities catalog on April 20. Three of them are in Cisco Catalyst SD-WAN Manager, and the remediation deadline for federal civilian agencies is April 23. Four days from disclosure to patch.
That deadline is the story.
What the Cisco Bugs Actually Are
Three CVEs, all confirmed exploited in the wild:
CVE-2026-20122 (CVSS 5.4) is improper use of privileged APIs. An attacker can upload or overwrite arbitrary files on the SD-WAN Manager and use that to escalate privileges. The CVSS is medium because the prerequisites limit the attack to authenticated users, but in the SD-WAN Manager threat model, "authenticated user" includes service accounts and integration credentials that often have weak storage and broad access.
CVE-2026-20128 (CVSS 7.5) is the meaty one. The SD-WAN Manager stores certain passwords in a recoverable format, which means an attacker who reaches the credential store, by any means, can pull plaintext credentials and pivot. This is the classic chain primer: compromise the appliance, pull every credential it stores, walk into the rest of the network using legitimate authentication.
CVE-2026-20133 (CVSS 6.5) is information disclosure. Sensitive system data exposed to unauthorized actors via remote access. On a SD-WAN Manager, "sensitive system data" includes routing configuration, tunnel keys, and integration tokens for the rest of the controller fabric.
Individually, none of these would normally rate a four-day federal deadline. Chained, they let an attacker take an internet-exposed SD-WAN Manager, pull credentials, get persistent access, and use the device as a pivot into every branch the SD-WAN fabric reaches. That is what the deadline is responding to.
Why the Deadline Matters
CISA's standard KEV remediation timeline for FCEB agencies is 21 days. The other five CVEs in this same April 20 drop, covering PaperCut NG/MF, JetBrains TeamCity, Quest KACE SMA, Zimbra Collaboration Suite, and Kentico Xperience, all got the standard May 4 deadline (~14 days). The Cisco trio got April 23. Four days.
CISA does not invent these numbers. The deadline reflects either evidence of widespread exploitation at scale, evidence of exploitation against specific high-value targets, or both. Federal agencies do not get a four-day deadline because the threat model is theoretical. Somebody at CISA looked at the telemetry and concluded that the cost of leaving these unpatched for the standard 21 days exceeded the cost of forcing a rushed maintenance window across the federal fleet.
You are not federal. You still inherit the same threat model. The attacker pool that is exploiting these against federal targets does not stop at the .gov boundary.
What to Do This Week
Three things.
One, inventory your SD-WAN Manager instances. The number of orgs that do not actually know how many SD-WAN Manager nodes they run is much higher than it should be, because the platform expanded through acquisition (vManage, vBond, vSmart) and the asset records did not consolidate. Pull the actual count from your network team, not from the CMDB.
Two, take any SD-WAN Manager that is reachable from the public internet off the public internet immediately. There is a legitimate reason for the orchestrator to be reachable from your branch routers. There is no legitimate reason for it to be reachable from the global internet. If your remote network team needs access, route them through a jump host with MFA. This is the same advice as last week's serial-to-IP converter writeup, and the same advice from every other "appliance with a web UI exposed" finding for the last decade. The pattern is durable for a reason.
Three, patch on the federal timeline, not your usual one. The Cisco advisory has fixed releases. Your change management process probably has a 14 to 30 day window for "non-emergency" patches. CISA just told you this is not non-emergency.
The four-day deadline is a leading indicator. The agencies are seeing something. You will see it next.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you'd rather know about your weak spots from a friendly face.