Cisco CVE-2026-20230 Added to CISA KEV Under Active Exploitation
Key findings • CISA added Cisco CVE-2026-20230 to the KEV catalog on June 25, 2026, confirming active exploitation. • Federal agencies must remediate by July 16, 2026, under BOD 22-01 require…
Key findings
- CISA added Cisco CVE-2026-20230 to the KEV catalog on June 25, 2026, confirming active exploitation.
- Federal agencies must remediate by July 16, 2026, under BOD 22-01 requirements.
- No ransomware association has been flagged for this vulnerability.
- Organizations should immediately inventory Cisco assets and apply available patches or mitigations.
The Cybersecurity and Infrastructure Security Agency (CISA) added a single Cisco vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on June 25, 2026, signaling that federal agencies and private-sector defenders alike must treat this flaw as an active, in-the-wild threat.
**CVE-2026-20230** is the sole entry in this KEV update. While Cisco has not yet publicly disclosed full technical details at the time of the catalog addition, the KEV listing confirms that the vulnerability is being actively exploited by malicious actors. The CVE identifier falls within Cisco's 2026 allocation range, suggesting a recently discovered or newly patched security issue in the vendor's extensive product portfolio.
CISA's decision to fast-track this vulnerability into the KEV catalog underscores the urgency. Under Binding Operational Directive (BOD) 22-01, all federal civilian executive branch agencies must remediate KEV-listed vulnerabilities by the prescribed due date — typically three weeks from the catalog addition. For CVE-2026-20230, that deadline falls on July 16, 2026.
No ransomware association has been flagged for this CVE in the KEV entry. However, active exploitation alone makes it a high-priority patch target for any organization running affected Cisco hardware or software. Security teams should consult Cisco's official advisory for the affected product list, patch availability, and any available workarounds or indicators of compromise.
Defenders are urged to inventory their Cisco deployments immediately, apply vendor-supplied patches or mitigations, and monitor for signs of post-exploitation activity. Even a single actively exploited flaw can serve as an initial access vector for broader network compromise.