CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation

CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, affecting Cisco SD-WAN, Chrome V8, and Arista EOS.

• •CVE-2026-20245 (CVSS 7.8): Improper encoding in Cisco Catalyst SD-WAN Manager allows authenticated local attackers to execute arbitrary commands as root
• •CVE-2026-11645 (CVSS 8.8): Out-of-bounds read/write in Chrome V8 enables remote code execution via crafted HTML pages
• •CVE-2026-7473 (CVSS 6.9): Incomplete comparison in Arista EOS causes incorrect tunnel decapsulation processing
• •Arista announced no patches planned due to risk of breaking existing configurations, offering ACL-based mitigations instead
• •FCEB agencies must apply fixes or mitigations by June 23, 2026