Cisco Catalyst SD-WAN auth bypass (CVE-2026-20127, then CVE-2026-20122 / -20128 / -20182 / -20133)

EPSS

0.258
likely to be attacked soon

VEDAS

0.568
some exploit evidence

On CISA KEV

Yes, since 2026-04-20

Detection rule

None yet

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

EPSS

0.893
very likely to be attacked soon

VEDAS

0.985
strong exploit evidence

On CISA KEV

Yes, since 2026-02-25

Detection rule

None yet

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

EPSS

0.073
some chance of attack soon

VEDAS

0.531
some exploit evidence

On CISA KEV

Yes, since 2026-04-20

Detection rule

Out of scope (local)

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

EPSS

0.315
likely to be attacked soon

VEDAS

0.578
some exploit evidence

On CISA KEV

Yes, since 2026-04-20

Detection rule

None yet

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

EPSS

0.918
very likely to be attacked soon

VEDAS

0.985
strong exploit evidence

On CISA KEV

Yes, since 2026-05-14

Detection rule

None yet

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.