Vulnerabilities & Exploits · Web App Attack

CISA Adds Four Actively Exploited Vulnerabilities to KEV

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. Affected products include Cisco Catalyst SD‑WAN, multiple Qualcomm chipsets, and Broadcom VMware Aria Operations.

6 sources · Mar 15

CVE-2026-20127

NVD KEV

Known exploited · CISA KEV

CVSS 10 CRITICAL: a vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco… EPSS 88% (100th percentile).

CISA federal remediation date Feb 27 · date passed

CVE-2022-20775

NVD KEV

Known exploited · CISA KEV

CVSS 7.8 HIGH: a vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated… EPSS 12% (96th percentile), up from 0.4%.

CISA federal remediation date Feb 27 · date passed

Timeline

Mar 15 Reported by BleepingComputer
Mar 12 Reported by Infosecurity Magazine
Mar 10 Reported by The Record from Recorded Future
Feb 27 CISA federal deadline for CVE-2026-20127 passed
Feb 25 CVE-2026-20127 added to CISA KEV
CVE-2022-20775 EPSS surged to 12%

Sources

Mar 15 BleepingComputer
CISA: Recently patched Ivanti EPM flaw now actively exploited
CISA flagged a high-severity Ivanti Endpoint Manager (EPM) vulnerability as actively exploited in attacks and ordered U.S.
original
Mar 12 Infosecurity Magazine
CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws
CISA issued urgent directive as attackers exploit Cisco SD-WAN flaw granting admin access to networks
original
Mar 12 CSO Online
CISA warns of actively exploited Ivanti EPM and Cisco SD-WAN flaws
Patched vulnerabilities in Ivanti Endpoint Manager and Cisco Catalyst SD-WAN are under attack, according to the US security agency, which added reporting requirements to its previous Cisco directive.
original

Vendor digest: Cisco

Part of the PlainSec briefing for 2026-03-04

Every edition of this story: CISA Adds Four Actively Exploited Vulnerabilities to KEV

More from today

Vulnerabilities & Exploits · Web App AttackCISA Adds Four Actively Exploited Vulnerabilities to KEVCISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. Affected products include Cisco Catalyst SD‑WAN, multiple Qualcomm chipsets, and Broadcom VMware Aria Operations.6 sources · Mar 15

CVE-2026-20127

NVD KEV

Known exploited · CISA KEV

CVSS 10 CRITICAL: a vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco… EPSS 88% (100th percentile).

CISA federal remediation date Feb 27 · date passed

CVE-2022-20775

NVD KEV

Known exploited · CISA KEV

CVSS 7.8 HIGH: a vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated… EPSS 12% (96th percentile), up from 0.4%.

CISA federal remediation date Feb 27 · date passed

Timeline

Mar 15 Reported by BleepingComputer

Mar 12 Reported by Infosecurity Magazine

Mar 10 Reported by The Record from Recorded Future

Feb 27 CISA federal deadline for CVE-2026-20127 passed

Feb 25 CVE-2026-20127 added to CISA KEV

CVE-2022-20775 EPSS surged to 12%

Sources

Mar 15 BleepingComputer

CISA: Recently patched Ivanti EPM flaw now actively exploited

CISA flagged a high-severity Ivanti Endpoint Manager (EPM) vulnerability as actively exploited in attacks and ordered U.S.

original

Mar 12 Infosecurity Magazine

CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws

CISA issued urgent directive as attackers exploit Cisco SD-WAN flaw granting admin access to networks

original

Mar 12 CSO Online

CISA warns of actively exploited Ivanti EPM and Cisco SD-WAN flaws

Patched vulnerabilities in Ivanti Endpoint Manager and Cisco Catalyst SD-WAN are under attack, according to the US security agency, which added reporting requirements to its previous Cisco directive.

original

Vendor digest: CiscoPart of the PlainSec briefing for 2026-03-04Every edition of this story: CISA Adds Four Actively Exploited Vulnerabilities to KEVMore from today

Actively Exploited Qualcomm Zero‑Day Hits Android Chipsets

CISA Adds VMware Aria Operations Flaw to KEV

Mass iPhone Attacks Tied to Coruna Exploit Kit