The week in breach news Mar 11, 2026

Cisco has warned users about two vulnerabilities in Catalyst SD-WAN Manager (formerly known as SD-WAN vManage) that are currently under active exploitation in the wild.

The vulnerabilities disclosed are:

• CVE-2026-20122 (CVSS score: 7.1) – An arbitrary file overwrite vulnerability that could allow an authenticated remote attacker to overwrite arbitrary files on the local file system. Successful exploitation requires valid read-only credentials with API access on the affected system.
• CVE-2026-20128 (CVSS score: 5.5) – An information disclosure vulnerability that could allow an authenticated local attacker to gain Data Collection Agent (DCA) user privileges on the affected system. Successful exploitation requires valid vManage credentials.

The company did not provide details about the scale of the attacks or the threat actors involved. The disclosure comes a week after Cisco reported that a critical vulnerability in Cisco Catalyst SD-WAN Controller and Catalyst SD-WAN Manager, tracked as CVE-2026-20127 with a CVSS score of 10.0, was exploited by a sophisticated threat actor known as UAT-8616 to establish persistent access to high-value organizations.

Cybercriminals continue to target critical infrastructure, with the ransomware group Qilin claiming it breached Tennessee Valley Electric Cooperative (TVEC), a U.S. electric cooperative.

Based in Savannah, Tennessee, TVEC provides electric service to customers in Wayne and Hardin counties in West Tennessee. The cooperative has not publicly addressed the ransomware gang's claims. However, based on the group's previous attacks, the stolen data could include employee information, customer records or internal organizational documents.

The group has previously targeted other U.S. electric cooperatives, including Karnes Electric Cooperative and San Bernard Electric Cooperative, last year.

The Wikimedia Foundation, the non-profit organization that hosts Wikipedia, experienced a significant security incident on March 5 involving a self-propagating JavaScript worm.

The issue came to light after users noticed a surge of automated edits that inserted hidden scripts and vandalized random pages. The worm modified user scripts and defaced Meta-Wiki pages. According to Wikimedia's Phabricator issue tracker, the attack appears to have begun when a malicious script hosted on Russian Wikipedia was executed, altering a global JavaScript script on Wikipedia with malicious code.

The malicious script, first uploaded in March 2024, is reportedly linked to scripts used in previous attacks targeting wiki projects.

The Dutch paint manufacturing giant AkzoNobel confirmed that hackers breached the network of one of its U.S. sites following a data leak from the Anubis ransomware gang.

AkzoNobel is a major paints and coatings company with well-known brands such as Dulux, Sikkens, International and Interpon under its corporate umbrella. The Anubis ransomware group claims to have stolen 170 GB of data from the company. Samples posted on its leak site reportedly include confidential agreements with high-profile clients, email addresses, phone numbers, private email correspondence, passport scans, material testing documents and internal technical specification sheets.

Meanwhile, the company stated that the impact appears limited and that it is taking appropriate steps to notify and support potentially affected parties.

Data analytics giant LexisNexis confirmed that its Legal & Professional division experienced a cybersecurity incident after the Fulcrumsec cybercrime group claimed responsibility for breaching the company.

On March 3, the cybercrime group claimed it stole 2 GB of data from LexisNexis Legal & Professional, including enterprise account data, employee credentials, software development secrets and personal information belonging to 400,000 individuals. The following day, March 4, the company confirmed the incident and said it had contained the breach, adding that neither its products nor services were compromised. According to the firm, only a limited number of servers were accessed, and the data stored on them mostly consisted of legacy and deprecated information from before 2020.

The attackers reportedly exfiltrated the files from a LexisNexis AWS instance by exploiting an unpatched React2Shell vulnerability.