7.8 CVSS score. Not the problem.
Per The Hacker News, an unknown threat actor exploited the Cisco Catalyst SD-WAN zero-day CVE-2026-20245 at least two months before public disclosure, as confirmed by Mandiant, while Matrice Digitale notes this vulnerability allows authenticated, local attackers to execute arbitrary commands with elevated privileges. SecurityWeek reports this as the 7th Cisco SD-WAN vulnerability exploited in 2026, with BleepingComputer detailing how hackers created rogue root accounts on targeted devices.
The conventional reading misses that this is not just a vulnerability problem, but a patch governance failure, with the flaw being exploited for months before patching, as highlighted by SecurityWeek. According to Mandiant, via The Hacker News, the average time to patch a vulnerability is 187 days, which is alarming given the 7.8 CVSS score of CVE-2026-20245. As Matrice Digitale and BleepingComputer report, GitHub has taken steps to secure its Actions, but the question remains how many other zero-days are being exploited in the shadows.
The defensive math: -> Implement a vulnerability management program that prioritizes zero-day exploits, reducing the average patch time to under 30 days, as recommended by SecurityWeek. -> Conduct regular configuration audits to detect and prevent rogue root accounts, as outlined in BleepingComputer's analysis. -> Develop an incident response plan that assumes zero-day exploitation, given the 89% increase in AI-enabled adversaries in 2025, per CrowdStrike's report, and the fact that 42% of exploited vulnerabilities in 2025 were weaponized before public disclosure, as noted by Mandiant.
What is the longest unpatched vulnerability window in your organization's history, and how will you ensure it doesn't become the next zero-day exploit?
https://tomodachi.work/zanshin/