Cisco SD-WAN Zero-Day Under Active Exploitation Grants Attackers Root

Back Cyberpress

Cisco SD-WAN Zero-Day Under Active Exploitation Grants Attackers Root

Cyberpress • February 26, 2026

Share: View original

Cisco has disclosed a critical zero - day vulnerability in its Catalyst SD-WAN Controller (formerly vSmart) and Catalyst SD-WAN Manager.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cisco SD-WAN Zero-Day Exploited by Threat Actor Since 2023 A cyber threat actor has been exploiting a zero-day vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller since 2023. This vulnerability allows unauthenticated remote attackers to bypass authentication and gain administrative privileges, potentially leading to long-term persistence in affected systems. Cisco and the Australian Cyber Security Centre have reported the ongoing exploitation of this vulnerability. 104 sources 82

Extracted Entities

Attack Types (1)

Zero-day Exploit

Companies (1)

MITRE ATT&CK (1)

T1068 - Exploitation for Privilege Escalation

Platforms (2)

Catalyst Sd-wan Controller Catalyst Sd-wan Manager