CISA added three vulnerabilities affecting Cisco Catalyst SD-WAN Manager to the Known Exploited Vulnerabilities catalog on April 20, setting a federal remediation deadline of April 23. The two-day window signals confirmed active exploitation that CISA considers urgent. Cisco SD-WAN Manager is the centralized administrative console controlling routing, configuration, and policy enforcement across enterprise wide-area networks. Owning it means owning the network fabric itself, not just a single host. The three flaws work as a chain. CVE-2026-20133 is an unauthenticated information disclosure flaw. An attacker with no credentials sends a crafted HTTP request to the API and reads sensitive configuration data, system files, and credentials stored on the appliance. CVE-2026-20122 abuses privileged API endpoints through improper file handling, letting an attacker with read-only API access overwrite arbitrary files and escalate to vManage-level privileges. CVE-2026-20128 targets how the platform stores Data Collection Agent credentials in recoverable format. A low-privileged local user reads a credential file and gains full DCA admin access. Run them in sequence: gather intelligence remotely with no credentials, use that access to escalate API privileges, overwrite system files, then extract stored credentials for full administrative control. Cisco confirmed active exploitation of CVE-2026-20122 and CVE-2026-20128 in March 2026. Patches were available before the KEV listing.

Microsoft released out-of-band emergency updates on April 19 that address the domain controller restart loop first covered in Issue 7. The root cause was a conflict between the April Patch Tuesday update KB5082063 and LSASS processing in multi-domain forests using Privileged Access Management. Affected domain controllers experienced repeated LSASS crashes at startup, locking out authentication and directory services and in some environments making the entire domain unavailable. The fix is KB5091157 for Windows Server 2025 and KB5091575 for Windows Server 2022. Both are available through Windows Update, Microsoft Update Catalog, and WSUS. The update preserves all security fixes from the original April cumulative update while resolving the LSASS regression. Systems still stuck in a restart loop need manual recovery through the Windows Recovery Environment before the patch can be applied.

No change from Issue 8. RedSun and UnDefend have been publicly available as working exploit code since April 16 and Microsoft has not shipped patches or a remediation timeline. Both remain in active exploitation. RedSun abuses Defender's cloud file rollback mechanism to achieve SYSTEM-level code execution via NTFS junction manipulation, with near-complete reliability on Windows 10, 11, and Server 2019 and later. UnDefend silently blocks Defender from receiving signature updates while the endpoint continues reporting healthy in management consoles. Attackers run them in sequence: UnDefend first to freeze threat intelligence without triggering alerts, then RedSun to escalate. Huntress has confirmed both techniques in live incidents. This item moves to Monitoring in the next issue if no patch materializes.