CVE-2026-20127 could allow an unauthenticated attacker to bypass authentication and gain administrative privileges
CVE-2026-20127 could allow an unauthenticated attacker to bypass authentication and gain administrative privileges
The following platforms are known to be affected:
Cisco Catalyst SD-WAN Controller
(Formerly SD-WAN vSmart)
(Formerly SD-WAN vManage)
Additional Detail on Affected Products
CVE-2026-20127 affects the following Catalyst SD-WAN deployment types:
The Cisco SD-WAN solution has been rebranded as Cisco Catalyst SD-WAN. In addition, from Cisco IOS XE SD-WAN Release 17.12.1a and Cisco Catalyst SD-WAN Release 20.12.1, the following component changes apply:
Cisco has released a security advisory to address a critical vulnerability in Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart) and Catalyst SD-WAN Manager (formerly SD-WAN vManage). Cisco Catalyst SD-WAN is a software-defined wide area network solution that enables secure, scalable, and flexible connectivity across enterprise networks.
Exploitation of CVE-2026-20127
Cisco, the National Cyber Security Centre (NCSC-UK), and other Five Eyes intelligence partners, have reported zero-day exploitation of CVE-2025-20127 by multiple threat actors, with observed exploitation activity as early as 2023.
Edge devices like Cisco Catalyst SD-WAN are often internet-facing by design and are highly attractive targets to attackers, and there are an increasing number of edge device vulnerabilities disclosed each year that are rapidly exploited by attackers. The NHS England National CSOC assesses it is highly likely vulnerabilities discovered in edge devices will continue to be exploited as zero-day vulnerabilities, or shortly after vendor disclosure.
Organisations are strongly encouraged to follow NCSC-UK's vulnerability management guidance , including patching edge devices as soon as possible if a critical vulnerability is identified.
Cisco has released another security advisory to address the following vulnerabilities in Catalyst SD-WAN:
These 5 vulnerabilities are not currently exploited, and are remediated in the patches for CVE-2026-20127.
Affected organisations must review Cisco security advisory cisco-sa-sdwan-rpa-EHchtZk and complete the remediation steps detailed below.
Optional: Perform a Comprehensive Compromise Assessment
The Australian Signals Directorate, in partnership with NCSC-UK and other Five Eyes intelligence partners, has published a comprehensive threat hunting guide to detect evidence of compromise. Organisations are strongly encouraged to review this document and perform a compromise assessment.
Note: Organisations are strongly encouraged to complete this step first; or collect all relevant artifacts, including a snapshot of the device and all logs, to support threat hunting after patching. Patching before conducting the compromise assessment or collecting relevant artifacts may delete critical evidence.
If evidence of compromise is detected, organisations must immediately report this to the NHS England National Cyber Security Operations Centre (CSOC) by calling 0300 303 5222 or emailing [email protected] .
Required: Update to a Fixed Version
Organisations must update Catalyst SD-WAN Controller and Catalyst SD-WAN Manager to a fixed version. Applying the patch for CVE-2026-20127 also remediates the other vulnerabilities disclosed by Cisco and mentioned in this Cyber Alert.
Organisations are strongly encouraged to use the Cisco Software Checker tool to determine the latest available version for their deployment.
Note: Catalyst SD-WAN releases earlier than 20.9 are end-of-life. Organisations running an end-of-life version must migrate to a supported version and apply the patch to address CVE-2026-20127.
Optional: Hardening Guidance for Cisco Catalyst SD-WAN
Organisations are strongly encouraged to follow Cisco's hardening guidance for Catalyst SD-WAN.
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
Last edited: 26 February 2026 12:31 pm
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
