erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: February 25, 2026

1 editorial brief, 2 known exploited (cisa kev) additions and 18 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: Cisco SD-WAN CVE-2026-20127: CVSS 10 Bypass, ED 26-03. Owners of on-prem or Cisco-hosted Catalyst SD-WAN Controller, Manager or Validator deployments, especially with ports 22/830 or the web UI reachable from untrusted networks.
  • Do you run any of these? Cisco Catalyst SD-WAN Controller and Manager, Cisco SD-WAN. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-02-27.
  • npm: 13 critical advisories (n8n, @angular/ssr, @nguniversal/common, @nguniversal/express-engine, budibase, parse-dashboard, @oneuptime/common, @enclave-vm/core …). Check with npm audit (or: npm ls <package>).
  • PyPI: 2 critical advisories (bugsink, flask-reuploaded). Check with pip-audit (or: pip show <package>).
  • Go: 2 critical advisories (github.com/OliveTin/OliveTin, code.vikunja.io/api). Check with govulncheck ./....
  • crates.io (Rust): 1 critical advisory (rustfs). Check with cargo audit.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-20127, CVE-2022-20775

Cisco SD-WAN CVE-2026-20127: CVSS 10 Bypass, ED 26-03

If you run on-prem Catalyst SD-WAN control components, upgrade and hunt now: a sophisticated actor has used this bypass for years, and the follow-on SD-WAN bugs CISA keeps adding to KEV show the platform is still being targeted.

Must act: Owners of on-prem or Cisco-hosted Catalyst SD-WAN Controller, Manager or Validator deployments, especially with ports 22/830 or the web UI reachable from untrusted networks.

Can relax: Organizations without Cisco Catalyst SD-WAN; branch routers alone are not the vulnerable component.

  1. Snapshot control components and collect logs before changing anything
  2. Upgrade Controller, Manager and Validator to a fixed release from Cisco's advisory
  3. Restrict ports 22 and 830 to known controller IPs and trusted hosts

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-20127Cisco Catalyst SD-WAN Controller and Manager
Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability		2026-02-27
CVE-2022-20775Cisco SD-WAN
Cisco SD-WAN Path Traversal Vulnerability		2026-02-27

Critical advisories by ecosystem 18

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 13

Check: npm audit (or: npm ls <package>)

Go 2

Check: govulncheck ./...

PyPI 2

Check: pip-audit (or: pip show <package>)

crates.io (Rust) 1

Check: cargo audit