Urgent Security Alert: Microsoft Exchange and Cisco SD-WAN Zero-Days Under Active Exploitation

Featured image: Photo by panumas nikhomkhai on Pexels.

Organizations worldwide are currently facing an urgent cybersecurity threat as two distinct zero-day vulnerabilities, one impacting Microsoft Exchange Server and another affecting Cisco Catalyst SD-WAN Controller, are under active exploitation. These critical flaws pose significant risks, potentially allowing attackers to gain unauthorized access, execute malicious code, and compromise vital network infrastructure. Rapid identification and remediation are paramount to safeguard systems against these ongoing attacks.

Microsoft Exchange Server Zero-Day (CVE-2026-42897)

Microsoft has issued a critical warning regarding a newly discovered security vulnerability in on-premise versions of Exchange Server, tracked as CVE-2026-42897. This flaw is a high-severity spoofing bug, specifically a cross-site scripting (XSS) vulnerability, which has been actively exploited in the wild [1, 4]. The vulnerability carries a CVSS score of 8.1, indicating its significant potential impact [1].

The exploitation chain for CVE-2026-42897 involves threat actors leveraging a crafted email. When an Outlook on the web user interacts with such an email, the XSS flaw can be triggered, potentially allowing attackers to execute arbitrary code within the context of the user’s browser session [4]. This could lead to various malicious activities, including data theft, credential compromise, or further penetration into the affected organization’s network.

An anonymous researcher has been credited with discovering and reporting this critical issue to Microsoft, highlighting the ongoing vigilance required in the cybersecurity landscape [1]. The active exploitation of this vulnerability underscores the immediate need for organizations utilizing on-premise Exchange Servers to implement available mitigations and apply security updates as soon as they are released. Failure to do so leaves a significant window for attackers to compromise email systems, which are often central to an organization’s operations and communication.

The nature of this XSS vulnerability means that user interaction, even seemingly innocuous actions like opening an email, can be enough to trigger an exploit. This makes user education and robust email security gateways crucial layers of defense in addition to server-side patching. Organizations should also consider strengthening their endpoint detection and response (EDR) capabilities to identify and respond to any post-exploitation activities that might arise from such an attack.

Cisco Catalyst SD-WAN Controller Zero-Day (CVE-2026-20182)

Concurrently, Cisco has alerted its customers about a maximum-severity authentication bypass flaw, CVE-2026-20182, affecting its Catalyst SD-WAN Controller. This vulnerability has a critical CVSS score of 10.0, signifying the highest possible severity [3]. Reports indicate that this flaw is also under active exploitation in limited attacks, allowing threat actors to gain administrative privileges on compromised devices [3, 5].

The vulnerability specifically resides in the peering authentication mechanism within Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart) and Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) [3]. An authentication bypass of this magnitude means that an attacker could potentially circumvent security controls designed to verify user identity, thereby gaining unauthorized administrative access to the SD-WAN infrastructure. This level of access grants attackers full control over the network’s routing, policies, and overall management, enabling them to disrupt services, redirect traffic, or establish persistent footholds within the network.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recognized the extreme severity and active exploitation of CVE-2026-20182 by adding it to its Known Exploited Vulnerabilities (KEV) catalog [2]. This action mandates that Federal Civilian Executive Branch (FCEB) agencies remediate the issue by May 17, 2026, highlighting the urgency for all organizations, public and private, to address this flaw without delay [2].

For organizations relying on Cisco Catalyst SD-WAN for their network infrastructure, the implications of this vulnerability are profound. Compromise of the SD-WAN controller can lead to a complete loss of network control, data interception, and the potential for lateral movement across an organization’s entire distributed network. Immediate application of Cisco’s released updates is not merely recommended but absolutely essential to prevent catastrophic network compromise.

The Peril of Actively Exploited Zero-Days

The simultaneous exploitation of these two zero-day vulnerabilities in widely used enterprise technologies — email servers and network controllers — paints a stark picture of the current threat landscape. Zero-day exploits are particularly dangerous because they target previously unknown or unpatched flaws, meaning organizations have little to no time to prepare defenses before attacks begin. The fact that both Microsoft and Cisco have confirmed active exploitation means that malicious actors are already leveraging these vulnerabilities to achieve their objectives.

The rapid response from vendors and government agencies like CISA underscores the critical nature of these threats. For organizations, this means moving beyond routine patching schedules and adopting an agile, threat-informed approach to security operations. Proactive threat hunting, continuous vulnerability management, and a robust incident response plan become indispensable tools when facing such dynamic and severe threats.

Furthermore, the targeting of both communication infrastructure (Exchange) and network backbone (SD-WAN) suggests a sophisticated

Sources

1. [1] On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email (feeds.feedburner.com)
2. [2] CISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access Exploits (feeds.feedburner.com)
3. [3] Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access (feeds.feedburner.com)
4. [4] Microsoft warns of Exchange zero-day flaw exploited in attacks (www.bleepingcomputer.com)
5. [5] Cisco warns of new critical SD-WAN flaw exploited in zero-day attacks (www.bleepingcomputer.com)

StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.