CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog Affecting Arista EOS, Google Chromium V8, and Cisco SD-WAN Infrastructure

Threat Summary

Category: CISA Known Exploited Vulnerabilities (KEV) Alert / Network Infrastructure Security / Browser Security / Enterprise Management Systems
Affected Technology: Arista Extensible Operating System (EOS), Google Chromium V8 Engine, Cisco Catalyst SD-WAN Manager
Primary Risk: Active exploitation enabling unauthorized access, code execution, infrastructure compromise, and enterprise network exposure
Exploitation Status: Confirmed active exploitation in the wild
Target Environment: Government networks, enterprise infrastructure, cloud-connected environments, browser deployments, network management platforms, telecommunications environments, critical infrastructure sectors
Operational Impact: Network compromise, unauthorized access, credential theft, remote code execution, lateral movement, infrastructure disruption, enterprise exposure
Threat Surface: Internet-facing management systems, enterprise browsers, network infrastructure appliances, SD-WAN management platforms
Vendor: Arista Networks, Google, Cisco Systems
CVE: CVE-2026-7473, CVE-2026-11645, CVE-2026-20245
KEV Added: June 9, 2026
Status: Added to CISA’s Known Exploited Vulnerabilities Catalog following evidence of active exploitation activity

The Cybersecurity and Infrastructure Security Agency (CISA) has added three newly identified vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog after confirming evidence of active exploitation affecting technologies widely deployed throughout enterprise, government, and critical infrastructure environments.

The newly added vulnerabilities include CVE-2026-7473 affecting Arista Extensible Operating System (EOS), CVE-2026-11645 impacting the Google Chromium V8 JavaScript engine, and CVE-2026-20245 affecting Cisco Catalyst SD-WAN Manager infrastructure.

Federal cybersecurity officials continue warning that vulnerabilities involving network infrastructure, browser platforms, and centralized management systems remain among the most attractive targets for threat actors due to the potential operational access these systems provide once compromised.

The Arista EOS vulnerability involves an incomplete comparison with missing factors weakness that may allow attackers to bypass intended security controls under certain conditions. Arista EOS serves as the operating platform for network switching and routing infrastructure deployed throughout enterprise environments, service providers, cloud environments, educational institutions, government agencies, and critical infrastructure networks.

The Chromium V8 vulnerability involves an out-of-bounds read and write flaw affecting one of the most widely deployed browser engines in the world. V8 powers Google Chrome and numerous Chromium-based browsers used across enterprise and government environments. Memory corruption vulnerabilities within browser engines frequently attract rapid weaponization efforts because successful exploitation can potentially enable code execution, browser compromise, credential theft, sandbox escape attempts, and delivery of additional malicious payloads.

The Cisco Catalyst SD-WAN Manager vulnerability involves improper encoding or escaping of output, creating potential opportunities for attackers to exploit management infrastructure responsible for controlling distributed enterprise networking environments. SD-WAN platforms often occupy highly privileged positions within enterprise architectures, making them particularly valuable targets for advanced threat actors.

Cybersecurity investigators continue observing increased targeting of centralized management platforms, network orchestration systems, cloud management interfaces, identity infrastructure, VPN platforms, firewalls, and enterprise administration tools. Successful compromise of these systems can provide attackers with visibility and control extending across large portions of organizational infrastructure.

CISA stated that vulnerabilities added to the KEV Catalog represent confirmed high-priority threats actively exploited against real-world targets. Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies must remediate KEV-listed vulnerabilities by established deadlines to reduce exposure to ongoing cyber threats.

Although the directive formally applies only to federal civilian agencies, CISA continues urging all organizations to prioritize remediation of KEV-listed vulnerabilities within their vulnerability management programs.

Security officials continue warning that threat actors increasingly weaponize newly disclosed vulnerabilities at accelerated speeds, particularly when vulnerabilities affect network infrastructure, browser technologies, authentication systems, cloud environments, and enterprise management platforms deployed across large-scale environments.

Organizations operating affected Arista, Google Chromium, or Cisco infrastructure are being encouraged to identify exposed assets, review vendor security guidance, apply available patches or mitigations, monitor systems for suspicious activity, review authentication and administrative logs, and prioritize remediation efforts immediately.

Failure to address actively exploited vulnerabilities affecting critical infrastructure components can increase exposure to ransomware operations, espionage campaigns, credential compromise, persistence mechanisms, network infiltration activity, and broader enterprise compromise attempts.

Infrastructure at Risk

• Government network environments
• Enterprise network infrastructure
• Cisco SD-WAN deployments
• Arista routing and switching environments
• Chromium-based browser deployments
• Telecommunications infrastructure
• Cloud-connected enterprise networks
• Financial sector infrastructure
• Healthcare organizations
• Educational institutions

Vendor Defense / Reliance

• CISA KEV Catalog monitoring
• Vendor-issued security updates
• Vulnerability management programs
• Enterprise patch management
• Network monitoring operations
• Administrative access controls
• Threat hunting activities
• Security operations center monitoring
• Infrastructure hardening initiatives
• Incident response readiness

Forecast — 30 Days

• Increased scanning for vulnerable Cisco SD-WAN systems
• Expanded exploitation targeting browser vulnerabilities
• Elevated attacker interest in network management infrastructure
• Rapid patch deployment efforts across enterprise environments
• Increased threat intelligence activity surrounding affected products
• Additional exploitation attempts against internet-facing infrastructure
• Continued inclusion of infrastructure vulnerabilities in ransomware operations
• Potential discovery of related vulnerabilities affecting enterprise environments

TRJ Verdict

The latest KEV additions reinforce a growing cybersecurity reality: attackers are increasingly targeting the systems organizations depend on to operate, manage, and secure their networks rather than focusing solely on end-user devices.

Network operating systems, browser engines, and centralized management platforms collectively form the backbone of modern digital infrastructure. When vulnerabilities affecting those systems become actively exploited, the risk extends well beyond a single device and can impact entire enterprise environments.

The inclusion of Arista EOS, Google Chromium V8, and Cisco SD-WAN Manager in the KEV Catalog highlights the continuing shift toward attacks aimed at infrastructure control points where a single compromise can create broad operational consequences.

Organizations that delay remediation of actively exploited infrastructure vulnerabilities continue increasing their exposure to ransomware, espionage operations, credential theft campaigns, and long-term network compromise activity.

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE