CVE-2026-20122 - PatchNow

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-02-25

Added to CISA KEV: 2026-04-20 54 DAYS BETWEEN CVE AND KEV

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
URGENT: Apply Cisco security patches immediately - prioritize systems with internet exposure
IMMEDIATE: Review API access logs for suspicious file upload activities or unauthorized privilege escalations
Implement network segmentation to limit API access from untrusted networks
Monitor for unexpected file modifications and privilege changes on vmanage systems
Audit and restrict API credentials, especially read-only accounts with API access
PATCH PRIORITY: CRITICAL - Apply patches within 72 hours due to active exploitation

CVE-2026-20122 - National Vulnerability Database
This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by ...
CISA Adds One Known Exploited Vulnerability to Catalog | CISA
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
NVD - CVE-2023-20122
CVE-2023-20122 Detail. Modified.Description. Multiple vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure could allow an authenticated, local attacker to escape the restricted shell and gain root privileges on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.
Known Exploited Vulnerabilities Catalog - CISA
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...
The Kev Catalog
A list of Known Exploited Vulnerabilities.

🔴 CVE-2026-20122