Log in Request a demo

Exploited vulnerability

Cisco SD-WAN authentication bypass (CVE-2026-20127)

CVE-2026-20127

CVE-2026-20127 is a flaw in the way Cisco Catalyst SD-WAN systems check the identity of other devices that connect to them.

  • On CISA KEV
CVE ID
CVE-2026-20127
CISA KEV
Listed
Affected product
Cisco Catalyst SD-WAN Controller, Manager and Validator (formerly vSmart, vManage and vBond)
Exploited
Yes
Published
February 2026

In short

CVE-2026-20127 is a flaw in the way Cisco Catalyst SD-WAN systems check the identity of other devices that connect to them. An attacker with no account can get administrator rights on the control system that manages a company's sites. CISA calls it a zero-day, meaning it was used before a fix existed.

Profile MapVulnerability
  1. CVECVE-2026-20127
  2. ProductCisco Cisco Catalyst SD-WAN Controller, Manager and Validator (formerly vSmart, vManage and vBond)
  3. CISA KEVListedKnown Exploited Vulnerabilities
  4. ExploitedYesin real attacks
  5. Fix Steps5actions listedUpgrade to a fixed release · Cut internet exposure

What it allows

An unauthenticated attacker over the network can send crafted requests and log in to an affected Controller as an internal, high-privileged user that is not root. From there the attacker can reach NETCONF, the interface used to change network settings, and so change the configuration of the whole SD-WAN. Cisco and NVD both give it a CVSS v3.1 score of 10.0 (Critical). Cisco says there are no workarounds.

Who is affected

Per Cisco, the flaw affects Catalyst SD-WAN Controller, Manager and Validator regardless of device configuration, in on-prem deployments and in Cisco-hosted SD-WAN cloud (Cisco-managed and FedRAMP). Cisco lists first fixed releases: 20.9.8.2, 20.12.5.3 and 20.12.6.1, 20.15.4.2 and 20.18.2.1. Releases earlier than 20.9, and the 20.11, 20.13, 20.14 and 20.16 trains, have reached end of software maintenance, so customers must move to a fixed release.

Cisco first published its advisory on 25 February 2026 and says it is aware of limited exploitation. Cisco thanks the Australian Signals Directorate's Australian Cyber Security Centre for reporting the flaw. CISA issued Emergency Directive 26-03 the same day and added CVE-2026-20127, together with the older CVE-2022-20775, to its Known Exploited Vulnerabilities (KEV) catalog on 25 February 2026. The KEV entry gives a due date of 27 February 2026 and lists ransomware use as Unknown.

CISA's supplemental guidance says the flaw was a zero-day when it was exploited. Following recent reporting, CISA says the malicious activity likely began in 2023. In the attacks, a rogue device controlled by the attacker appears as a new and legitimate SD-WAN component and then carries out trusted actions in the management and control systems. International partners saw movement outside the SD-WAN and the removal of logs and command history.

No official source opened here names the actor. CISA's directive refers only to a cyber threat actor, so attribution is not public. CISA also directed US federal agencies to apply Cisco's updates by 27 February 2026, and to rebuild the control plane if a root-level compromise is found. The wider incident is covered on the Cisco SD-WAN exploitation page.

What to do

  1. Upgrade to a fixed release

    Move to the first fixed release for your train, such as 20.12.5.3, 20.12.6.1, 20.15.4.2 or 20.18.2.1. Cisco has no workaround, and trains that reached end of maintenance must migrate.

  2. Cut internet exposure

    Cisco advises blocking access from unsecured networks, allowing only known hosts, and placing the control systems behind a firewall. Disable HTTP and any service you do not need.

  3. Detect and hunt

    Check /var/log/auth.log for 'Accepted publickey for vmanage-admin' from IP addresses that are not your configured System IPs. Validate every control-connection peering event by time, source IP and peer type. CISA's hunt guidance goes further, and activity may date back to 2023.

  4. Keep logs off the device

    CISA says to store SD-WAN logs externally, because attackers cleared logs and history on the hosts. Collect an admin-tech file before opening a case with Cisco support.

  5. Rebuild if root access is found

    CISA's directive says that if a root account compromise is found, deploy fresh control components from patched images and move edge devices to them, and report to CISA.

Questions

What is CVE-2026-20127?

CVE-2026-20127 is an authentication bypass in the peering authentication of Cisco Catalyst SD-WAN Controller, Manager and Validator. An attacker with no account can log in as a high-privileged internal user and change the SD-WAN configuration through NETCONF. It scores CVSS 10.0.

Which Cisco SD-WAN releases are fixed?

Cisco lists first fixed releases 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2 and 20.18.2.1. Trains that reached end of software maintenance must migrate to a fixed release. Cisco says there are no workarounds.

Was CVE-2026-20127 exploited before a fix existed?

Yes. CISA calls it a zero-day and says the malicious activity likely began in 2023. CISA issued Emergency Directive 26-03 and added the flaw to its Known Exploited Vulnerabilities catalog on 25 February 2026.

How do I check for compromise from CVE-2026-20127?

Check /var/log/auth.log for 'Accepted publickey for vmanage-admin' from addresses that are not your configured System IPs, and validate every control-connection peering event. Store logs off the device, because attackers cleared logs on hosts.

Sources

  1. Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (cisco-sa-sdwan-rpa-EHchtZk) Cisco
  2. ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems CISA
  3. Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems CISA
  4. CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA
  5. CVE-2026-20127 record NIST NVD
  6. Known Exploited Vulnerabilities catalog CISA

Last updated October 2026

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Zero-day vulnerability

A zero-day vulnerability is a weakness in hardware, firmware or software that was previously unknown.

Read more