Cisco disclosed three vulnerabilities in Catalyst SD-WAN Manager on May 14, 2026, including a CVSS 9.5 unauthenticated XML injection flaw (CVE-2026-20224) that attackers can exploit remotely without credentials, combined with two privilege escalation vulnerabilities enabling full system compromise. All deployment types are affected, including FedRAMP-authorized government environments, and CISA has confirmed active exploitation of related SD-WAN vulnerabilities, issuing Emergency Directive ED 26-03 with mandatory hunt-and-harden requirements for federal agencies. No workarounds exist; patching is the only remediation path, and federal agencies are under mandatory compliance requirements per CISA Emergency Directive ED 26-03.