actively-exploited-vulnerabilitywidely-deployed-product-advisoryperimeter-device-exposuregovernment-vulnerability-catalog

Actively Exploited Critical Vulnerabilities in Cisco Secure Firewall and Catalyst SD-WAN Manager

Active Exploitation · 2 sources · Updated 4mo ago · First seen Mar 6, 2026

Belgium’s CCB (Safeonweb) warned of multiple critical vulnerabilities across several Cisco products—specifically calling out Cisco Secure Firewall (including Adaptive Security Appliance (ASA), Firepower Management Center (FMC), and Firepower Threat Defense (FTD)) and Cisco Catalyst SD-WAN Manager—and stated that some vulnerabilities are being actively exploited, urging immediate patching. The advisory lists a broad set of weakness classes including authentication bypass (CWE-288/CWE-287), deserialization of untrusted data (CWE-502), buffer overflow (CWE-120), SQL injection (CWE-89), and sensitive information exposure (CWE-200), and highlights multiple CVEs including CVE-2026-20079 and CVE-2026-20131 with CVSS 10.0.

A separate advisory from the Center for Internet Security (CIS) also reported multiple vulnerabilities in Cisco products that could enable remote code execution, enumerating a large set of related CVEs (including CVE-2026-20001, CVE-2026-20002, CVE-2026-20003, and CVE-2026-20039). Taken together, the advisories indicate a high-risk patching priority for organizations running affected Cisco network/security management and firewall platforms, particularly where internet exposure or untrusted management-plane access could make exploitation more likely.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Mar 5, 2026

Mar 5, 20268mo ago
Authorities and security organizations warn that some Cisco flaws are actively exploited
On the same day, Belgium's CCB Safeonweb warned about multiple critical Cisco vulnerabilities and urged immediate patching, noting that some were being actively exploited. CIS also issued an advisory aggregating the affected CVEs and Cisco security notices for defenders.
Mar 5, 20268mo ago
Cisco discloses multiple critical vulnerabilities across several products
Cisco published a set of security advisories covering multiple vulnerabilities in products including Cisco Secure Firewall and Cisco Catalyst SD-WAN Manager. The advisories referenced issues such as remote code execution, authentication bypass, SQL injection, command injection, directory traversal, cross-site scripting, and denial-of-service flaws.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Unauthenticated Java deserialization RCE in Cisco Secure Firewall Management Center (CVE-2026-20131)Authentication Bypass to Root Code Execution in Cisco Secure Firewall Management Center (CVE-2026-20079)

Organizations

1 linked

Cisco Systems

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Belgium Ccb Security AdvisoriesNews · Mar 5, 2026

Warning: Multiple critical vulnerabilities in several Cisco products, including Cisco Secure Firewall and Cisco Catalyst SD-WAN Manager. Some are being actively exploited, Patch Immediately! | CCB SafeonwebOpen source ↗

Cisecurity AdvisoriesNews · Mar 5, 2026

Multiple Vulnerabilities in Cisco Products Could Allow for Remote Code ExecutionOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Actively Exploited Critical Vulnerabilities in Cisco Secure Firewall and Catalyst SD-WAN Manager

How this story unfolded

Authorities and security organizations warn that some Cisco flaws are actively exploited

Cisco discloses multiple critical vulnerabilities across several products

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Cisco Patches Critical Firewall Management RCE Vulnerabilities

Cisco Patches Critical Catalyst SD-WAN Flaws in Controller and Manager

Cisco Patches Critical Authentication Bypass and Command Injection Flaws in IOS XE and SD-WAN

Actively Exploited Critical Vulnerabilities in Cisco Secure Firewall and Catalyst SD-WAN Manager

How this story unfolded

Authorities and security organizations warn that some Cisco flaws are actively exploited

Cisco discloses multiple critical vulnerabilities across several products

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Cisco Patches Critical Firewall Management RCE Vulnerabilities

Cisco Patches Critical Catalyst SD-WAN Flaws in Controller and Manager

Cisco Patches Critical Authentication Bypass and Command Injection Flaws in IOS XE and SD-WAN