The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation. The newly listed flaws affect products from Cisco, Google Chrome, and Arista Networks, signaling a broad cross-vendor threat landscape that security teams must address urgently.
The cataloged vulnerabilities include CVE-2026-20245, an improper encoding or escaping of output vulnerability in Cisco Catalyst SD-WAN Manager, which carries a CVSS score of 7.8. While specific details on the other two flaws were not disclosed in available reporting, the inclusion of Chrome and Arista flaws indicates these are being actively weaponized in the wild.
CVE-2026-20245 affects Cisco Catalyst SD-WAN Manager, a critical component for managing wide-area networks. The improper encoding vulnerability could allow an attacker to execute arbitrary code or cause a denial-of-service condition, though precise attack vectors and exploit mechanisms remain undisclosed in public reporting.
CISA has mandated that federal civilian executive branch agencies remediate these vulnerabilities by a specified deadline, though no specific patch timeline for Cisco, Google, or Arista products was provided in available information. Organizations are advised to consult vendor advisories and apply available updates as soon as possible.
No attribution for the exploitation was provided. The addition to KEV highlights the ongoing challenge of supply chain vulnerabilities spanning multiple vendors, reinforcing the need for prioritized patch management across diverse enterprise environments.