Back Csa.Sg Active Exploitation of Critical Vulnerability in Cisco Catalyst SD
Cisco has released a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN. Users and administrators of affected products are advised to upgrade to a fixed release immediately.
Cisco has released security updates to address a critical authentication bypass vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage). The vulnerability has a Common Vulnerability Scoring System (CVSS v3.1) score of 10 out of 10.
Successful exploitation of the authentication bypass vulnerability could allow an unauthenticated remote attacker to obtain administrative privileges on an affected system. This access enables manipulation of SD-WAN fabric configurations, insertion of rogue peers, and unauthorised control of network traffic. Attackers could then establish encrypted malicious connections and move laterally across organisational infrastructure.
This vulnerability is reportedly being exploited in the wild.
This vulnerability affects the following deployment types:
Cisco Hosted SD-WAN Cloud - Cisco Managed
Cisco Hosted SD-WAN Cloud - FedRAMP Environment
This vulnerability affects the following Cisco Catalyst SD‑WAN versions:
All releases earlier than 20.9
20.9.x prior to 20.9.8.2
20.12.x prior to 20.12.5.3 / 20.12.6.1
20.15.x prior to 20.15.4.2
20.18.x prior to 20.18.2.1
Users and administrators of affected products are advised to upgrade to a fixed release immediately and review systems for indicators of compromise (IoCs). After patching and checking for IoCs, environments should be hardened to reduce exposure.
For detailed guidance, please refer to Cisco’s official advisory here .
Indicators of Compromise
Possible IOCs to support immediate detection, hunting, and containment:
Log entries in /var/log/auth.log showing Accepted publickey for vmanage-admin from unknown or unauthorised IP addresses
Unexpected control‑connection peering events involving vmanage peers from unrecognised IP addresses or at unusual times
For additional details and guidance, please refer to Cisco’s official advisory here .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
