A zero-day vulnerability in Cisco's SD-WAN solution, identified as CVE-2026-20245, was exploited by attackers for months before a patch was released. This marks the seventh Cisco SD-WAN vulnerability to be exploited in 2026, highlighting the ongoing security challenges faced by the company. The vulnerability was actively used in attacks prior to its public disclosure, underscoring the need for prompt patching and monitoring. Cisco is currently engaged in discussions regarding the exploitation status of CVE-2026-20245, which will determine whether the issue warrants immediate patching or ongoing monitoring1. The fact that this vulnerability was exploited for an extended period before being addressed raises concerns about the potential for similar vulnerabilities to be exploited in the future. This incident matters to security practitioners because it emphasizes the importance of staying vigilant and proactive in patching and monitoring critical infrastructure, particularly in the face of active exploitation.