Skip to content
Active Exploitation of Critical Vulnerability in Cisco Catalyst SD

Active Exploitation of Critical Vulnerability in Cisco Catalyst SD

Csa.Sg February 26, 2026

Cisco has released a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN. Users and administrators of affected products are advised to upgrade to a fixed release immediately.

Cisco has released security updates to address a critical authentication bypass vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage). The vulnerability has a Common Vulnerability Scoring System (CVSS v3.1) score of 10 out of 10.

Successful exploitation of the authentication bypass vulnerability could allow an unauthenticated remote attacker to obtain administrative privileges on an affected system. This access enables manipulation of SD-WAN fabric configurations, insertion of rogue peers, and unauthorised control of network traffic. Attackers could then establish encrypted malicious connections and move laterally across organisational infrastructure.

This vulnerability is reportedly being exploited in the wild.

This vulnerability affects the following deployment types:

Cisco Hosted SD-WAN Cloud

Cisco Hosted SD-WAN Cloud - Cisco Managed

Cisco Hosted SD-WAN Cloud - FedRAMP Environment

This vulnerability affects the following Cisco Catalyst SD‑WAN versions:

All releases earlier than 20.9

20.9.x prior to 20.9.8.2

20.12.x prior to 20.12.5.3 / 20.12.6.1

20.15.x prior to 20.15.4.2

20.18.x prior to 20.18.2.1

Users and administrators of affected products are advised to upgrade to a fixed release immediately and review systems for indicators of compromise (IoCs). After patching and checking for IoCs, environments should be hardened to reduce exposure.

For detailed guidance, please refer to Cisco’s official advisory here .

Indicators of Compromise

Possible IOCs to support immediate detection, hunting, and containment:

Log entries in /var/log/auth.log showing Accepted publickey for vmanage-admin from unknown or unauthorised IP addresses

Unexpected control‑connection peering events involving vmanage peers from unrecognised IP addresses or at unusual times

For additional details and guidance, please refer to Cisco’s official advisory here .