Cisco Catalyst SD-WAN zero-day under active exploitation

A critical vulnerability in Cisco Catalyst SD-WAN Manager is being actively exploited in the wild, according to Infosecurity Magazine. The flaw allows an unauthenticated remote attacker to access systems with administrator privileges. Cisco has confirmed the vulnerability and released patches. SD-WAN platforms are used by many organisations to manage and optimise connectivity across distributed sites, branch offices, cloud environments and remote workers, making them high-value targets for attackers seeking persistent access to corporate networks. The vulnerability affects the management platform that controls routing, security policies and connectivity for entire networks.

Why this matters for UK organisations

The operational risk here is significant because SD-WAN management platforms sit at the centre of network architecture for many distributed organisations. An attacker gaining administrator access to an SD-WAN controller can reconfigure traffic flows, intercept data in transit, disable security controls, redirect traffic through attacker-controlled infrastructure or pivot into connected sites, branch offices and cloud environments. For UK businesses using Cisco SD-WAN infrastructure, particularly those with distributed operations, retail estates, manufacturing sites, logistics networks or remote offices, this vulnerability represents a direct threat to network integrity, the confidentiality of data in transit and the availability of connectivity across the organisation. The fact that exploitation is already happening means attackers are actively scanning for and targeting vulnerable systems, and the window for defensive action is narrow.

What to review

For many organisations, SD-WAN platforms are managed by network teams, infrastructure teams or third-party managed service providers rather than security teams, which can mean they are not always included in the same vulnerability management processes, patch cycles or monitoring as servers, endpoints or applications. This is a prompt to confirm that Cisco SD-WAN Manager instances have been patched, including any managed by third parties or hosted in remote locations. It is also worth reviewing whether network infrastructure is covered by the same patch management discipline, vulnerability scanning and security monitoring as other critical systems, and whether responsibility for patching network infrastructure is clearly assigned and understood across IT, security and any third-party providers. If patching cannot be completed immediately, consider whether temporary mitigations such as restricting management access, increasing monitoring or segmenting SD-WAN controllers can reduce exposure until patches are deployed.

Source: Infosecurity Magazine