CYBER THREATCAST

Cisco and Arista hit the top of the risk list as CISA remediation deadlines landed for two flaws already exploited in the wild: CVE-2026-20245 in Cisco Catalyst SD-WAN Manager and CVE-2026-7473 in Arista EOS. Cisco also disclosed active exploitation of CVE-2026-20230 in Unified CM and Unified CM SME, an SSRF and file-write bug that can end in root-level code execution on WebDialer-enabled systems. The immediate picture is familiar and ugly: edge, network, and communications platforms remain under active pressure while credential theft and follow-on access campaigns scale alongside them.

Cisco’s SD-WAN problems stand out on volume as much as severity. The Catalyst SD-WAN Manager flaw can enable root-level command execution, and Cisco said attackers can gain the needed access by chaining earlier vulnerabilities. Reporting tied the issue to the seventh Cisco SD-WAN zero-day confirmed exploited in 2026, a pace that raises the cost of patch lag for organizations that depend on the platform. In parallel, researchers said attackers are already scanning for and using public proof-of-concept code against Unified CM targets.

The rest of the landscape reinforces the same operational lesson. Researchers linked FortiBleed to a Russian-speaking initial access broker that targeted more than 430,000 FortiGate devices and harvested over 110 million credentials across platforms. ShinyHunters reportedly exploited Oracle PeopleSoft at more than 100 organizations, especially colleges and universities, and posted stolen student data. Outside enterprise IT, Taiko said attackers exploited its Vault smart contract for roughly $1 million before the company paused the chain and prepared a fix.