Article
Cyber incidents of 2026: lessons from official reports
Cyber incidents of 2026 and lessons from official reports: CISA, the UK NCSC and CERT Polska on the npm, SD-WAN and Poland energy cases,…
Read more
Significant cyber incident
Cisco SD-WAN exploitation
On 25 February 2026, CISA and partner agencies in Australia, Canada, New Zealand and the UK said attackers were breaking into Cisco SD-WAN systems worldwide.
In short
On 25 February 2026, CISA and partner agencies in Australia, Canada, New Zealand and the UK said attackers were breaking into Cisco SD-WAN systems worldwide. They used a zero-day flaw (CVE-2026-20127) to get in without a password, then an older flaw (CVE-2022-20775) to gain full control. These systems manage how company sites connect, so control gives attackers a trusted place inside the network.
What happened
On 25 February 2026, CISA issued Emergency Directive 26-03 and, with NSA and partner agencies from Australia, Canada, New Zealand and the UK, published guidance on attacks against Cisco SD-WAN systems. The agencies said that organizations around the world had been targeted and compromised. Cisco published its own advisories the same day.
The attackers used a flaw that was a zero-day when it was exploited. It let them log in to the SD-WAN control systems without credentials. They then used an older flaw to reach root level and kept long-term access. CISA said they also moved sideways outside the SD-WAN and deleted logs and other traces.
Later in 2026 more Cisco SD-WAN flaws were added to CISA’s list of exploited vulnerabilities. Public sources name no victims and give no count of affected organizations.
Timeline
-
2022-09-28
Cisco first publishes its advisory for CVE-2022-20775, the privilege escalation flaw
-
2023
CISA cites recent reporting that the malicious activity likely began in 2023
-
February 2026
Cisco becomes aware of attempted exploitation of CVE-2022-20775
-
2026-02-25
CISA issues Emergency Directive 26-03 and adds CVE-2026-20127 and CVE-2022-20775 to its Known Exploited Vulnerabilities catalog
-
2026-02-25
CISA, NSA and partners from Australia, Canada, New Zealand and the UK publish joint guidance and a threat hunt guide; Cisco publishes its advisory for CVE-2026-20127
-
2026-02-26
Federal agencies must send CISA their SD-WAN inventory and collect artifacts
-
2026-02-27
Federal agencies must apply Cisco's updates by 5:00 PM ET
-
March 2026
Cisco becomes aware of active exploitation of CVE-2026-20128 and CVE-2026-20122
-
2026-03-11
CISA updates Emergency Directive 26-03 with new and changed required actions
-
April 2026
Cisco becomes aware of active exploitation of CVE-2026-20133
-
2026-04-20
CISA adds CVE-2026-20133 to the Known Exploited Vulnerabilities catalog
-
mid-April 2026
CISA and a US federal partner find evidence of exploitation of CVE-2026-20182
-
2026-05-14
CISA adds CVE-2026-20182 to the Known Exploited Vulnerabilities catalog
How the attack worked
Step 1: get in without a password
Cisco says the peering authentication in the SD-WAN Controller, Manager and Validator was not working properly. A crafted request could let an unauthenticated attacker log in as an internal, high-privileged user. That account could reach NETCONF and change network configuration for the whole SD-WAN fabric. The flaw affected systems regardless of configuration. It was a zero-day when it was exploited.
Step 2: look like a real SD-WAN part
CISA says the attacker’s rogue device appeared as a new, temporary and legitimate SD-WAN component. It could then carry out trusted actions in the management and control planes. The UK NCSC describes this as adding a malicious rogue peer.
Step 3: reach root and stay
CISA and partners say the attackers then used CVE-2022-20775 to escalate privileges. Cisco says this older flaw lets a local attacker run commands as root. The agencies say the attackers then set up long-term persistence. CISA tells hunters to check for software downgrades, unexpected SSH keys for the vmanage-admin account and root logins.
Step 4: cover tracks and move on
International partners saw lateral movement outside the SD-WAN environment. The attacker cleared logs, command history, network connection history and configurations, and took steps to stop log forwarding. No opened source maps these steps to MITRE ATT&CK technique ids, so none are listed here.
Who says who was behind it
No public attribution. The opened CISA, NCSC UK, NCSC Ireland and Cisco pages refer to "a cyber threat actor", "malicious cyber actors" and "this cluster of cyber threat activity". Only Cisco Talos names the activity, tracking it as cluster UAT-8616; none of the pages names a country.
Malware and vulnerabilities used
Impact
CISA and partners say organizations around the world were targeted and compromised (CISA alert, 25 February 2026). The UK NCSC says the cluster of activity targeted organizations globally. No source opened here names a victim or gives a number of affected organizations.
Cisco rated CVE-2026-20127 at CVSS 10.0 (critical). It says it was aware of limited exploitation of that flaw. A successful attacker could change network configuration for the whole SD-WAN fabric.
CISA says the attackers moved sideways outside the SD-WAN environment and removed traces on the host. CISA cites recent reporting that the activity likely began in 2023.
Cisco later reported active exploitation of CVE-2026-20128 and CVE-2026-20122 (March 2026) and CVE-2026-20133 (April 2026). CISA reported evidence of exploitation of CVE-2026-20182 from mid-April.
Government and regulator response
- 25 February 2026: CISA issued Emergency Directive 26-03 and added CVE-2026-20127 and CVE-2022-20775 to its Known Exploited Vulnerabilities catalog. Federal agencies had to inventory SD-WAN systems and collect artifacts by 26 February, and apply Cisco’s updates by 27 February.
- 25 February 2026: CISA, NSA, ACSC (Australia), the Cyber Centre (Canada), NCSC-NZ and NCSC-UK released joint guidance and a threat hunt guide. The UK NCSC urged immediate investigation, full updating and hardening, and asked UK organizations that suspect compromise to report to it.
- 25 February 2026: Cisco published its advisories and fixed releases. Cisco says there are no workarounds. As a temporary step it advised limiting ports 22 and 830 to known controller IPs. It credits the Australian ACSC with reporting CVE-2026-20127.
- 26 February 2026: the Irish NCSC published its own advisory on the Cisco flaws.
- 11 March 2026: CISA updated the directive. It added a requirement to send SD-WAN syslogs to CISA’s logging warehouse by 23 March, and requires a rebuild of the control and management plane if root compromise is found.
- 20 April and 14 May 2026: CISA added CVE-2026-20133 and CVE-2026-20182 to the Known Exploited Vulnerabilities catalog and updated its alert.
Lessons
-
Management planes are prime targets
The attackers went after the systems that control the SD-WAN, and a rogue device could look like a real part and take trusted actions. Whoever controls the management plane controls the network.
-
Exposure decides risk
The UK NCSC says management interfaces must never be exposed to the internet, and Cisco and CISA both advise firewalls and allowlists for control components.
-
Patching did not end the work
The flaw was a zero-day, so fixes came after exploitation. CISA says activity likely began in 2023, so hunting back in time mattered as much as patching.
-
Logs on the device cannot be trusted
The attacker cleared logs and tried to stop log forwarding. CISA and Cisco both say to store logs outside the SD-WAN.
-
Old flaws still get used
CVE-2022-20775 was published by Cisco in 2022 and was used in 2026 to gain root. Unpatched older bugs can finish an attack that a new bug starts.
-
Compromise can mean a full rebuild
CISA says that if root was compromised, the control and management plane must be rebuilt from patched images with new admin accounts.
What to check in your own organization
-
Find every SD-WAN system
List all Cisco Catalyst SD-WAN Manager, Controller and Validator instances you run, on premises or hosted, and their software versions against Cisco's fixed releases.
-
Check exposure
Confirm the management interfaces and control components cannot be reached from the internet, VPN 512 sits in an isolated management network, and only known IPs can connect.
-
Review peering events
Check every control connection peering event, especially vmanage and vsmart peers, against your asset list and change records. Look for unknown public IPs.
-
Audit SSH and root logins
Look in auth.log for public key logins by vmanage-admin from unknown addresses. Check authorized_keys for keys you did not add. Treat any root login as a warning.
-
Look for downgrades and reboots
Compare software version changes and reboots with your approved change plan.
-
Send logs off the device
Forward SD-WAN logs to a central system and alert on new peering and successful logins. Check that the forwarding still works.
-
Plan a rebuild
Decide now how you would deploy fresh SD-WAN components from patched images and move edge devices to them if root compromise is found.
Where it happened
Questions
What happened in the Cisco SD-WAN attacks of 2026?
On 25 February 2026 CISA and partner agencies said attackers were compromising Cisco SD-WAN systems worldwide. They used an authentication bypass (CVE-2026-20127) and then an older flaw (CVE-2022-20775) to gain root and persistence.
Who was behind it?
No public attribution. The opened government pages name no group or country. Cisco Talos tracks the activity as cluster UAT-8616 but names no country.
When did it start?
CISA cites recent reporting that the malicious activity likely began in 2023. The public alerts came on 25 February 2026.
Was it a zero-day?
Yes for CVE-2026-20127. CISA says it was a zero-day at the time of exploitation and has since been patched by Cisco.
What did CISA require?
Federal civilian agencies had to inventory SD-WAN systems, collect artifacts, apply Cisco updates, hunt for compromise and harden systems, with dates from 26 February 2026. CISA urged all organizations to use the guidance.
Is there a workaround?
Cisco says there are no workarounds for CVE-2026-20127. It advises upgrading to a fixed release. As a temporary step it advises limiting ports 22 and 830 to known controller IPs.
In our research
Sources
- ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems CISA
- CISA and Partners Release Guidance for Ongoing Global Exploitation of Cisco SD-WAN Systems CISA
- Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems CISA
- Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability Cisco (product owner)
- Cisco Catalyst SD-WAN Vulnerabilities Cisco (product owner)
- Cisco SD-WAN Software Privilege Escalation Vulnerabilities Cisco (product owner)
- Exploitation of Cisco Catalyst SD-WAN National Cyber Security Centre (UK)
- Critical Vulnerabilities in Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager National Cyber Security Centre (Ireland)
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.