{"metadata": {"vulnerability": "cve-2026-20128", "count": 117, "kinds": {"milestone": 8, "sighting": 57, "kev": 17, "other": 35}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0071", "record": "NCSC-2026-0071", "field": "document.tracking.generator.date"}, {"timestamp": "2025-10-08T11:59:15.379Z", "date_only": false, "value": "2025-10-08T11:59:15.379Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-20128", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-02-25T00:00:00Z", "date_only": false, "value": "2026-02-25T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0210", "record": "CERTFR-2026-AVI-0210", "field": "last_revision_date"}, {"timestamp": "2026-02-25T00:00:00Z", "date_only": true, "value": "2026-02-25", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0210", "record": "CERTFR-2026-AVI-0210", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-02-25T00:00:00Z", "date_only": false, "value": "2026-02-25T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-20128", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-02-25T00:00:00Z", "date_only": false, "value": "2026-02-25T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-20128", "record": "FKIE_CVE-2026-20128", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-02-25T00:00:00Z", "date_only": false, "value": "2026-02-25T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0210", "record": "CERTFR-2026-AVI-0210", "field": "revisions.0.revision_date"}, {"timestamp": "2026-02-25T15:59:38Z", "date_only": false, "value": "2026-02-25T15:59:38+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-SDWAN-AUTHBP-QWCX8D4V", "record": "CISCO-SA-SDWAN-AUTHBP-QWCX8D4V", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-02-25T16:00:00Z", "date_only": false, "value": "2026-02-25T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-SDWAN-AUTHBP-QWCX8D4V", "record": "CISCO-SA-SDWAN-AUTHBP-QWCX8D4V", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-02-25T16:14:12.353Z", "date_only": false, "value": "2026-02-25T16:14:12.353Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-20128", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-02-25T16:34:22Z", "date_only": false, "value": "2026-02-25T16:34:22.000000Z", "kind": "sighting", "label": "Seen", "source": "https://vulnerability.circl.lu/bundle/b24f0b20-207c-4881-af91-eb1d15b224ba", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "dcac2404-b7a9-464e-b436-781894a19bff", "url": "https://vulnerability.circl.lu/bundle/b24f0b20-207c-4881-af91-eb1d15b224ba"}, {"timestamp": "2026-02-25T17:00:08.671Z", "date_only": false, "value": "2026-02-25T17:00:08.671305Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mfp5rtagrx26", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "53009f4c-2b91-4f69-a6e6-dd803edd01eb", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mfp5rtagrx26"}, {"timestamp": "2026-02-25T17:11:09.013Z", "date_only": false, "value": "2026-02-25T17:11:09.013125Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0071", "record": "NCSC-2026-0071", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-02-25T17:11:09.013Z", "date_only": false, "value": "2026-02-25T17:11:09.013125Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0071", "record": "NCSC-2026-0071", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-02-25T17:25:30Z", "date_only": false, "value": "2026-02-25T17:25:30Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MP6J-7G85-8PG2", "record": "GHSA-MP6J-7G85-8PG2", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-02-25T17:25:30.150Z", "date_only": false, "value": "2026-02-25T17:25:30.150000", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202602-4602", "record": "VAR-202602-4602", "field": "sources_release_date.data.1.date"}, {"timestamp": "2026-02-25T17:25:30.150Z", "date_only": false, "value": "2026-02-25T17:25:30.150", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-20128", "record": "FKIE_CVE-2026-20128", "field": "published"}, {"timestamp": "2026-02-25T17:29:05Z", "date_only": false, "value": "2026-02-25T17:29:05.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/rilevato-sfruttamento-di-vulnerabilita-in-prodotti-cisco", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "41e5bbf9-a752-4209-94c6-0fcd3645855f", "url": "https://www.acn.gov.it/portale/w/rilevato-sfruttamento-di-vulnerabilita-in-prodotti-cisco"}, {"timestamp": "2026-02-25T17:40:22.758Z", "date_only": false, "value": "2026-02-25T17:40:22.758773Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfp7zskmoa2x", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "188ba8c7-2a8e-4551-a8d4-08518bd30cb5", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfp7zskmoa2x"}, {"timestamp": "2026-02-25T17:40:49.070Z", "date_only": false, "value": "2026-02-25T17:40:49.070186Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfpa2lptbi2x", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "f828cccb-1613-48e3-9aea-180ec28633b5", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfpa2lptbi2x"}, {"timestamp": "2026-02-25T18:31:38Z", "date_only": false, "value": "2026-02-25T18:31:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MP6J-7G85-8PG2", "record": "GHSA-MP6J-7G85-8PG2", "field": "published"}, {"timestamp": "2026-02-25T18:43:06Z", "date_only": false, "value": "2026-02-25T18:43:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/kriittisia-haavoittuvuuksia-cisco-catalyst-sd-wan-tuotteissa", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "58869f9c-6934-43e9-825d-eab4728fa8af", "url": "https://www.kyberturvallisuuskeskus.fi/fi/kriittisia-haavoittuvuuksia-cisco-catalyst-sd-wan-tuotteissa"}, {"timestamp": "2026-02-25T19:26:43Z", "date_only": false, "value": "2026-02-25T19:26:43.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.si/si-cert-2026-01/", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "ba4b1084-df4c-49ee-8852-5b9da788464c", "url": "https://www.cert.si/si-cert-2026-01/"}, {"timestamp": "2026-02-25T20:03:01Z", "date_only": false, "value": "2026-02-25T20:03:01.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-166", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "570429fa-77bc-43ff-a62c-116e117408cd", "url": "https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-166"}, {"timestamp": "2026-02-25T23:00:00Z", "date_only": false, "value": "2026-02-25T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0516", "record": "WID-SEC-W-2026-0516", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-02-25T23:00:00Z", "date_only": false, "value": "2026-02-25T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0516", "record": "WID-SEC-W-2026-0516", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-02-25T23:00:00Z", "date_only": false, "value": "2026-02-25T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0516", "record": "WID-SEC-W-2026-0516", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-02-26T07:45:00Z", "date_only": false, "value": "2026-02-26T07:45:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.se/2026/02/kritisk-nolldagssarbarhet-i-cisco-catalyst-sd-wan.html", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "50a34af1-b5ab-4dde-a549-e8290b12b6eb", "url": "https://www.cert.se/2026/02/kritisk-nolldagssarbarhet-i-cisco-catalyst-sd-wan.html"}, {"timestamp": "2026-02-26T11:58:53Z", "date_only": false, "value": "2026-02-26T11:58:53.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.at/de/warnungen/2026/2/kritische-sicherheitslucken-in-cisco-catalyst-sd-wan-aktiv-ausgenutzt-updates-verfugbar", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "7f6ced43-9335-4df8-b45e-75d43ee3b193", "url": "https://www.cert.at/de/warnungen/2026/2/kritische-sicherheitslucken-in-cisco-catalyst-sd-wan-aktiv-ausgenutzt-updates-verfugbar"}, {"timestamp": "2026-03-04T21:13:56.113Z", "date_only": false, "value": "2026-03-04T21:13:56.113000", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202602-4602", "record": "VAR-202602-4602", "field": "sources_update_date.data.1.date"}, {"timestamp": "2026-03-04T22:20:10.368Z", "date_only": false, "value": "2026-03-04T22:20:10.368084Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgbcwkndfq2q", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "9f48c7bd-d852-4d59-aebe-b30f120106d9", "url": "https://bsky.app/profile/cyberhub.blog/post/3mgbcwkndfq2q"}, {"timestamp": "2026-03-04T23:00:00Z", "date_only": false, "value": "2026-03-04T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0516", "record": "WID-SEC-W-2026-0516", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-03-05T00:06:17Z", "date_only": false, "value": "2026-03-05T00:06:17+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-SDWAN-AUTHBP-QWCX8D4V", "record": "CISCO-SA-SDWAN-AUTHBP-QWCX8D4V", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-03-05T11:06:47Z", "date_only": false, "value": "2026-03-05T11:06:47.000000Z", "kind": "sighting", "label": "Seen", "source": "https://threatintel.cc/2026/03/05/cisco-flags-more-sdwan-flaws.html", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "2f231039-aeee-4963-bba8-99d60b2924e7", "url": "https://threatintel.cc/2026/03/05/cisco-flags-more-sdwan-flaws.html"}, {"timestamp": "2026-03-05T12:06:41.335Z", "date_only": false, "value": "2026-03-05T12:06:41.335310Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/116176479912988309", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "65c171f5-945b-4cec-9618-8acce5ec20a9", "url": "https://infosec.exchange/users/edwardk/statuses/116176479912988309"}, {"timestamp": "2026-03-05T12:07:17.441Z", "date_only": false, "value": "2026-03-05T12:07:17.441553Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mgcr5jawyk2x", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "55c966b1-c3bf-43f0-af0a-73bad23d2fc3", "url": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mgcr5jawyk2x"}, {"timestamp": "2026-03-05T15:23:45Z", "date_only": false, "value": "2026-03-05T15:23:45.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/8543", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "91358124-5342-4835-b45c-16736e4f7a39", "content": "\u26a0\ufe0f Cisco confirms active exploitation of two Catalyst SD-WAN Manager flaws.\n\n\u25b6 CVE-2026-20122 enables arbitrary file overwrite via API credentials.\n\u25b6CVE-2026-20128 can expose data and grant DCA privileges after login.\n\n\ud83d\udd17 Read \u2192 https://thehackernews.com/2026/03/cisco-confirms-active-exploitation-of.html\n\nPatches are out across multiple releases.", "url": "https://t.me/thehackernews/8543"}, {"timestamp": "2026-03-05T16:31:14.640Z", "date_only": false, "value": "2026-03-05T16:31:14.640525Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/solidot.bsky.social/post/3mgd7vksqzs2o", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "ec97b2f5-b862-472a-84b5-b30edec44715", "url": "https://bsky.app/profile/solidot.bsky.social/post/3mgd7vksqzs2o"}, {"timestamp": "2026-03-05T17:00:08Z", "date_only": false, "value": "2026-03-05T17:00:08.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/7969", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "85a734d4-046e-4b29-9834-0a038487d72c", "content": "Cisco \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0432\u043e\u043b\u043d\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0434\u0432\u0443\u0445 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Catalyst SD-WAN \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445.\n\n25 \u0444\u0435\u0432\u0440\u0430\u043b\u044f \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a \u0443\u0432\u0435\u0434\u043e\u043c\u0438\u043b \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0434\u043b\u044f\u00a0\u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Catalyst SD-WAN, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f root.\u00a0\n\n\u041f\u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e \u043d\u0430 5 \u043c\u0430\u0440\u0442\u0430 Cisco \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0430 \u0441\u0432\u043e\u0435 \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0435 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u0432 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0435\u0439 \u0441\u0442\u0430\u043b\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043e\u0431 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0434\u0432\u0443\u0445 \u0438\u0437 \u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2026-20128 \u0438 CVE-2026-20122.\n\n\u041f\u0435\u0440\u0432\u0430\u044f, CVE-2026-20128, - \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0430\u0433\u0435\u043d\u0442\u0430 \u0441\u0431\u043e\u0440\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 (DCA) \u0432 Catalyst SD-WAN Manager. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f DCA \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u0414\u0440\u0443\u0433\u0430\u044f, CVE-2026-20122, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0443\u044e API Catalyst SD-WAN Manager. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438.\n\n\u0412 Cisco \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u044d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u043e \u0432 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u043e, \u0447\u0442\u043e \u043e\u043d\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u044b \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438.\n\n\u041d\u043e \u0441\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u0442\u0430\u0442\u0443\u0441\u0430 \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u043e \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u0434\u0435\u043b\u044e \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a Cisco \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439\u00a00-day, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Catalyst SD-WAN.\n\nCVE-2026-20127 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\n\u0422\u043e\u0433\u0434\u0430 CISA \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u0430, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u043b\u0430\u0441\u044c \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u0431\u043e\u043b\u0435\u0435 \u0441\u0442\u0430\u0440\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e Catalyst, CVE-2022-20775, \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\nCisco Talos \u0441\u0432\u044f\u0437\u0430\u043b\u0430 \u044d\u0442\u0438 \u0430\u0442\u0430\u043a\u0438 \u0441 UAT-8616, \u043f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 2023 \u0433\u043e\u0434\u0430.\u00a0\u041d\u043e \u043d\u0435\u044f\u0441\u043d\u043e, \u0431\u044b\u043b\u0438 \u043b\u0438 \u0432\u0441\u0435 \u044d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Catalyst SD-WAN \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0432 \u043e\u0434\u043d\u043e\u0439 \u0438\u043b\u0438 \u0440\u0430\u0437\u043d\u044b\u0445 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f\u0445.\u00a0\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, Cisco \u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u043b\u0430 \u0430\u0442\u0430\u043a\u0438 \u0441 \u043d\u0443\u043b\u044f\u043c\u0438,\u00a0\u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u044b\u043c\u0438 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 APT, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043a\u0430\u043a UAT-9686. \u0412 \u043e\u0431\u0449\u0435\u043c, \u0431\u0443\u0434\u0435\u043c \u0441\u043b\u0435\u0434\u0438\u0442\u044c.", "url": "https://t.me/true_secator/7969"}, {"timestamp": "2026-03-05T18:17:57.005Z", "date_only": false, "value": "2026-03-05T18:17:57.005069Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/firstpasslab.bsky.social/post/3mgdfudtaec2t", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "a51ab98c-d446-4902-adc9-ec98cf405778", "url": "https://bsky.app/profile/firstpasslab.bsky.social/post/3mgdfudtaec2t"}, {"timestamp": "2026-03-05T20:45:14Z", "date_only": false, "value": "2026-03-05T20:45:14.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cKure/16043", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "72dbc48d-046f-4e7c-9734-ed427206ed3c", "content": "\u25a0\u25a0\u25a1\u25a1\u25a1 \u26a0\ufe0f Cisco confirms active exploitation of two Catalyst SD-WAN Manager flaws.\n\n\u25b6 CVE-2026-20122 enables arbitrary file overwrite via API credentials.\n\u25b6CVE-2026-20128 can expose data and grant DCA privileges after login.\n https://thehackernews.com/2026/03/cisco-confirms-active-exploitation-of.html", "url": "https://t.me/cKure/16043"}, {"timestamp": "2026-03-05T23:00:00Z", "date_only": false, "value": "2026-03-05T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0516", "record": "WID-SEC-W-2026-0516", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-03-06T00:00:00Z", "date_only": false, "value": "2026-03-06T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202602-4602", "record": "VAR-202602-4602", "field": "sources_release_date.data.0.date"}, {"timestamp": "2026-03-06T00:00:00Z", "date_only": false, "value": "2026-03-06T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-06)", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "dccd7b6b-69a5-4f6e-be97-77d9b2fe4878"}, {"timestamp": "2026-03-06T00:00:00Z", "date_only": false, "value": "2026-03-06T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-06)", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "fe3ddf05-4ce9-4262-9a36-96d26b9ae234"}, {"timestamp": "2026-03-06T06:39:00Z", "date_only": false, "value": "2026-03-06T06:39:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202602-4602", "record": "VAR-202602-4602", "field": "sources_update_date.data.0.date"}, {"timestamp": "2026-03-06T06:43:53.998Z", "date_only": false, "value": "2026-03-06T06:43:53.998274Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mgepk4y3yk2h", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "1d6991ed-84f5-4b73-afd5-add63b7e9af6", "url": "https://bsky.app/profile/shiojiri.com/post/3mgepk4y3yk2h"}, {"timestamp": "2026-03-06T07:24:19.834Z", "date_only": false, "value": "2026-03-06T07:24:19.834138Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0071", "record": "NCSC-2026-0071", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-03-06T11:07:02Z", "date_only": false, "value": "2026-03-06T11:07:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0071", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "4ec1fd7d-eafe-4a82-a3ec-bf4baaa7af25", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0071"}, {"timestamp": "2026-03-06T12:07:02.595Z", "date_only": false, "value": "2026-03-06T12:07:02.595940Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0071", "record": "NCSC-2026-0071", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-03-06T12:07:02.595Z", "date_only": false, "value": "2026-03-06T12:07:02.595940Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0071", "record": "NCSC-2026-0071", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-03-06T12:30:03.374Z", "date_only": false, "value": "2026-03-06T12:30:03.374128Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mgfcv6epdc23", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "20bf2f00-3406-4646-9910-46f596ab7b40", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mgfcv6epdc23"}, {"timestamp": "2026-03-06T14:25:28.093Z", "date_only": false, "value": "2026-03-06T14:25:28.093813Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hack4career.com/post/3mgfjdl24bc25", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "cbb7ac3a-25db-4ce7-a844-2ead19d5dde8", "url": "https://bsky.app/profile/hack4career.com/post/3mgfjdl24bc25"}, {"timestamp": "2026-03-06T15:20:00Z", "date_only": false, "value": "2026-03-06T15:20:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.ncsc.nl/alerts/actief-misbruik-van-kwetsbaarheden-in-cisco-producten", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "1e2b998e-b9d8-44eb-949e-9948da176f76", "url": "https://www.ncsc.nl/alerts/actief-misbruik-van-kwetsbaarheden-in-cisco-producten"}, {"timestamp": "2026-03-06T17:20:05.198Z", "date_only": false, "value": "2026-03-06T17:20:05.198636Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mgft3sath72m", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "9cb4d656-6180-4beb-b4d1-aa1ee9205f5b", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mgft3sath72m"}, {"timestamp": "2026-03-06T17:59:40.361Z", "date_only": false, "value": "2026-03-06T17:59:40.361401Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ehcgroup.bsky.social/post/3mgfvck6wfs26", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "bc3c9180-b69f-4bf9-ab61-01b172458be5", "url": "https://bsky.app/profile/ehcgroup.bsky.social/post/3mgfvck6wfs26"}, {"timestamp": "2026-03-06T18:05:43.036Z", "date_only": false, "value": "2026-03-06T18:05:43.036120Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sctocs.bsky.social/post/3mgfvn535zs2t", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "cf5d02ea-7edf-4f7f-894e-a49fc6a2c0bd", "url": "https://bsky.app/profile/sctocs.bsky.social/post/3mgfvn535zs2t"}, {"timestamp": "2026-03-06T21:03:00.389Z", "date_only": false, "value": "2026-03-06T21:03:00.389389Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mgg7kcsqtw2q", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "6c401869-561e-4e41-96c3-d91d2d68852d", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mgg7kcsqtw2q"}, {"timestamp": "2026-03-06T22:35:44Z", "date_only": false, "value": "2026-03-06T22:35:44+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2026-20128", "field": "timestamps.asserted_at", "uuid": "47fdb12a-12c7-4ddc-9401-48b4bfa282eb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-03-06T22:35:44Z", "date_only": false, "value": "2026-03-06T22:35:44+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2026-20128", "field": "timestamps.first_seen_at", "uuid": "47fdb12a-12c7-4ddc-9401-48b4bfa282eb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-03-07T00:00:00Z", "date_only": false, "value": "2026-03-07T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-07)", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "71ad014e-37f0-4e9c-8496-2caf48252a30"}, {"timestamp": "2026-03-07T19:18:31.561Z", "date_only": false, "value": "2026-03-07T19:18:31.561673Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mgik6iv3ac23", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "ed87dfd4-6ae3-4d9a-b9f2-adcf2260abf0", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mgik6iv3ac23"}, {"timestamp": "2026-03-08T00:00:00Z", "date_only": false, "value": "2026-03-08T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-08)", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "a78aa9ac-cc84-4b01-956d-5a451b35ac43"}, {"timestamp": "2026-03-09T00:00:00Z", "date_only": false, "value": "2026-03-09T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-010/", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "e013d363-ca1b-43aa-8db5-d502a4d52a54", "url": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-010/"}, {"timestamp": "2026-03-09T00:00:00Z", "date_only": false, "value": "2026-03-09T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-09)", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "c08f9fbf-3e7a-4ded-9733-60e7e52a13ff"}, {"timestamp": "2026-03-09T23:47:49.683Z", "date_only": false, "value": "2026-03-09T23:47:49.683000Z", "kind": "other", "label": "Last update date", "source": "variot \u00b7 VAR-202602-4602", "record": "VAR-202602-4602", "field": "last_update_date"}, {"timestamp": "2026-03-10T00:00:00Z", "date_only": false, "value": "2026-03-10T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-10)", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "c3f74f7b-7221-4f7e-987a-032f69438a5e"}, {"timestamp": "2026-03-18T01:06:38Z", "date_only": false, "value": "2026-03-18T01:06:38+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-SDWAN-AUTHBP-QWCX8D4V", "record": "CISCO-SA-SDWAN-AUTHBP-QWCX8D4V", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-03-18T15:19:49.502Z", "date_only": false, "value": "2026-03-18T15:19:49.502256Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/116250849364616830", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "3972d397-6fa0-49a9-b803-c1cdeb3efdf4", "url": "https://infosec.exchange/users/AAKL/statuses/116250849364616830"}, {"timestamp": "2026-03-19T00:00:00Z", "date_only": false, "value": "2026-03-19T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-19)", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "e6ff67f8-e4bb-44f4-a352-4f4c1e24cc41"}, {"timestamp": "2026-03-19T00:00:00Z", "date_only": false, "value": "2026-03-19T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-19)", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "8d2e75f8-0a03-4de7-a572-6642f90053e2"}, {"timestamp": "2026-03-20T00:00:00Z", "date_only": false, "value": "2026-03-20T00:00:00+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2026-20128", "field": "timestamps.last_seen_at", "uuid": "47fdb12a-12c7-4ddc-9401-48b4bfa282eb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-03-20T00:00:00Z", "date_only": true, "value": "2026-03-20", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2026-20128", "field": "evidence.0.details.observation_date", "uuid": "47fdb12a-12c7-4ddc-9401-48b4bfa282eb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-03-20T00:00:00Z", "date_only": false, "value": "2026-03-20T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-20)", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "3fd13e7f-3ed3-402e-92e4-530d64f57ad9"}, {"timestamp": "2026-03-20T00:00:00Z", "date_only": false, "value": "2026-03-20T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2026-20128", "field": "status.status_updated_at", "uuid": "47fdb12a-12c7-4ddc-9401-48b4bfa282eb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-03-20T21:47:33.415Z", "date_only": false, "value": "2026-03-20T21:47:33.415Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / cisco", "record": "cve-2026-20128", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-20128", "field": "timestamps.asserted_at", "uuid": "f027f136-8e3d-44c8-9bf6-c9060b220e88", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": true, "value": "2026-04-20", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-20128", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": true, "value": "2026-04-20", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-20128", "field": "evidence.0.details.date_added", "uuid": "f027f136-8e3d-44c8-9bf6-c9060b220e88", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-20128", "field": "timestamps.first_seen_at", "uuid": "f027f136-8e3d-44c8-9bf6-c9060b220e88", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-20128", "field": "status.status_updated_at", "uuid": "f027f136-8e3d-44c8-9bf6-c9060b220e88", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-20128", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-04-20T20:00:02Z", "date_only": false, "value": "2026-04-20T20:00:02+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-20128", "field": "timestamps.recorded_at", "uuid": "f027f136-8e3d-44c8-9bf6-c9060b220e88", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-20T20:00:03.396Z", "date_only": false, "value": "2026-04-20T20:00:03.396671Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/f027f136-8e3d-44c8-9bf6-c9060b220e88", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "80685e19-7586-48d5-a626-0ce9dd024140", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/f027f136-8e3d-44c8-9bf6-c9060b220e88"}, {"timestamp": "2026-04-20T20:00:03.483Z", "date_only": false, "value": "2026-04-20T20:00:03.483374Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9ef4bbca-93a6-4add-bce2-2196e27c7ec5", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "1e1ae5ae-3e2d-4b26-9faf-5995db7e8ccd", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9ef4bbca-93a6-4add-bce2-2196e27c7ec5"}, {"timestamp": "2026-04-20T21:31:38Z", "date_only": false, "value": "2026-04-20T21:31:38Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MP6J-7G85-8PG2", "record": "GHSA-MP6J-7G85-8PG2", "field": "modified"}, {"timestamp": "2026-04-20T22:00:00Z", "date_only": false, "value": "2026-04-20T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0516", "record": "WID-SEC-W-2026-0516", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-04-20T22:00:00Z", "date_only": false, "value": "2026-04-20T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0516", "record": "WID-SEC-W-2026-0516", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-04-21T03:55:31.648Z", "date_only": false, "value": "2026-04-21T03:55:31.648Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-20128", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-04-21T03:55:31.648Z", "date_only": false, "value": "2026-04-21T03:55:31.648Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-20128", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-21T06:56:53Z", "date_only": false, "value": "2026-04-21T06:56:53.000000Z", "kind": "sighting", "label": "Seen", "source": "https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-several-cisco-products-including-cisco-secure", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "959a6831-54b9-4e44-91ed-e5f08688f8fb", "url": "https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-several-cisco-products-including-cisco-secure"}, {"timestamp": "2026-04-21T08:09:54.503Z", "date_only": false, "value": "2026-04-21T08:09:54.503+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0516", "record": "WID-SEC-W-2026-0516", "field": "document.tracking.generator.date"}, {"timestamp": "2026-04-22T15:10:56Z", "date_only": false, "value": "2026-04-22T15:10:56+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-SDWAN-AUTHBP-QWCX8D4V", "record": "CISCO-SA-SDWAN-AUTHBP-QWCX8D4V", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-04-22T15:10:56Z", "date_only": false, "value": "2026-04-22T15:10:56+00:00", "kind": "other", "label": "Updated", "source": "csaf_cisco \u00b7 CISCO-SA-SDWAN-AUTHBP-QWCX8D4V", "record": "CISCO-SA-SDWAN-AUTHBP-QWCX8D4V", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-04-22T15:11:01Z", "date_only": false, "value": "2026-04-22T15:11:01+00:00", "kind": "other", "label": "Document generated", "source": "csaf_cisco \u00b7 CISCO-SA-SDWAN-AUTHBP-QWCX8D4V", "record": "CISCO-SA-SDWAN-AUTHBP-QWCX8D4V", "field": "document.tracking.generator.date"}, {"timestamp": "2026-04-22T18:03:54.406Z", "date_only": false, "value": "2026-04-22T18:03:54.406119Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/116449675412278045", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "7932c93b-439f-4bd7-914b-14f3743683e2", "url": "https://infosec.exchange/users/AAKL/statuses/116449675412278045"}, {"timestamp": "2026-04-23T00:00:00Z", "date_only": true, "value": "2026-04-23", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-20128", "field": "evidence.0.details.due_date", "uuid": "f027f136-8e3d-44c8-9bf6-c9060b220e88", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-26T06:14:16.878Z", "date_only": false, "value": "2026-04-26T06:14:16.878002Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mkevo53epc2s", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "c7053533-c75c-4a95-92ee-7263675c6f71", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mkevo53epc2s"}, {"timestamp": "2026-05-15T06:03:19Z", "date_only": false, "value": "2026-05-15T06:03:19.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-012-critical-vulnerability-affecting-cisco-catalyst-sd-wan-cve-2026-20182", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "c23c0113-8d7e-46a3-85c4-8393ead78e44", "url": "https://cyber.gc.ca/en/alerts-advisories/al26-012-critical-vulnerability-affecting-cisco-catalyst-sd-wan-cve-2026-20182"}, {"timestamp": "2026-06-01T13:22:22Z", "date_only": false, "value": "2026-06-01T13:22:22+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2026-20128", "field": "timestamps.asserted_at", "uuid": "8744b00f-6311-4e6c-a8a8-6b84e9cbc2dc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:22:22Z", "date_only": false, "value": "2026-06-01T13:22:22+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2026-20128", "field": "timestamps.first_seen_at", "uuid": "8744b00f-6311-4e6c-a8a8-6b84e9cbc2dc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:22:22Z", "date_only": false, "value": "2026-06-01T13:22:22+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2026-20128", "field": "status.status_updated_at", "uuid": "8744b00f-6311-4e6c-a8a8-6b84e9cbc2dc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:22:22.629Z", "date_only": false, "value": "2026-06-01T13:22:22.629Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2026-20128", "field": "evidence.0.details.added_date", "uuid": "8744b00f-6311-4e6c-a8a8-6b84e9cbc2dc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-07T16:32:02.249Z", "date_only": false, "value": "2026-06-07T16:32:02.249526Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mnplrje4632q", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "62070a76-37ee-4573-a871-0431af1a69c1", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mnplrje4632q"}, {"timestamp": "2026-06-17T10:17:10.543Z", "date_only": false, "value": "2026-06-17T10:17:10.543", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-20128", "record": "FKIE_CVE-2026-20128", "field": "lastModified"}, {"timestamp": "2026-06-19T12:41:46Z", "date_only": false, "value": "2026-06-19T12:41:46+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2026-20128", "field": "timestamps.recorded_at", "uuid": "8744b00f-6311-4e6c-a8a8-6b84e9cbc2dc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-19T12:42:06.064Z", "date_only": false, "value": "2026-06-19T12:42:06.064339Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/8744b00f-6311-4e6c-a8a8-6b84e9cbc2dc", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "4a1986d7-d1e4-49da-b391-924d1e55aabb", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/8744b00f-6311-4e6c-a8a8-6b84e9cbc2dc"}, {"timestamp": "2026-06-19T12:45:13.106Z", "date_only": false, "value": "2026-06-19T12:45:13.106308Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8a8ebb8f-ca49-418c-8b26-f22be6bc97da", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "c396d072-8e97-428b-8883-555234e8b1ae", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8a8ebb8f-ca49-418c-8b26-f22be6bc97da"}, {"timestamp": "2026-06-23T14:03:39.462Z", "date_only": false, "value": "2026-06-23T14:03:39.462650Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d2b6432d-f19c-4849-b070-a2a389d9510e", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "823a256c-7d90-4c53-9a0b-36918d3c1b23", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d2b6432d-f19c-4849-b070-a2a389d9510e"}, {"timestamp": "2026-06-30T10:01:24.366Z", "date_only": false, "value": "2026-06-30T10:01:24.366074Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e56c0a2d-7130-42eb-8cc3-e9266451a0a3", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "38ccd377-e671-41be-af8a-5cee27f87e05", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e56c0a2d-7130-42eb-8cc3-e9266451a0a3"}, {"timestamp": "2026-07-01T07:18:37.358Z", "date_only": false, "value": "2026-07-01T07:18:37.358849Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/47fdb12a-12c7-4ddc-9401-48b4bfa282eb", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "c1b7f678-998f-40ef-8a3a-ece4de6156e8", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/47fdb12a-12c7-4ddc-9401-48b4bfa282eb"}, {"timestamp": "2026-07-01T11:42:35Z", "date_only": false, "value": "2026-07-01T11:42:35+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2026-20128", "field": "timestamps.recorded_at", "uuid": "47fdb12a-12c7-4ddc-9401-48b4bfa282eb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-05T10:00:05.238Z", "date_only": false, "value": "2026-08-05T10:00:05.238295Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-04)", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "7d460d99-cb75-4cf7-994d-c0054b2183f6"}, {"timestamp": "2026-08-18T19:00:04.571Z", "date_only": false, "value": "2026-08-18T19:00:04.571341Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/42060", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "02a13e72-4ae3-48cb-b584-4750fbb4b987", "url": "https://t.me/VulnerabilityNews/42060"}, {"timestamp": "2026-08-19T00:00:09.521Z", "date_only": false, "value": "2026-08-19T00:00:09.521351Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/42060", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "6840906a-dbcd-4072-803a-0db171a9feef", "url": "https://t.me/VulnerabilityNews/42060"}, {"timestamp": "2026-09-01T17:00:12.854Z", "date_only": false, "value": "2026-09-01T17:00:12.854248Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/7871", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "b9e3cd8e-a98c-4f9a-9d95-ce27d23d0fa8", "url": "https://t.me/cissp/7871"}, {"timestamp": "2026-09-12T10:00:03.665Z", "date_only": false, "value": "2026-09-12T10:00:03.665813Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-11)", "record": "CVE-2026-20128", "field": "creation_timestamp", "uuid": "7660aac9-e097-42d9-87dc-56ea0540e2b8"}]}