Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Authentication Bypass Remote attackers can bypass SD-WAN authentication without valid credentials or trusted Cisco-issued certificates. Unauthorized Control-Plane Access Attackers can join the SD-WAN control plane as a trusted peer by abusing the vHub authentication path. Network Traffic Manipulation Malicious actors may modify routing behavior, redirect traffic, or manipulate WAN orchestration policies across the SD-WAN fabric.
March 9, 2026: Rapid7 makes initial outreach to Cisco who confirms contact the same day. Rapid7 discloses the technical writeup and exploit code to Cisco. March 11, 2026: Cisco confirms receipt of the technical writeup and exploit code and suggests a disclosure date of May 7, 2026. March 20, 2026: Cisco confirms the vulnerability findings, and that a CVE will be reserved. April 21, 2026: Cisco provides reserved CVE identifier and remediation guidance.
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
