Back Securityaffairs.Co

Hackers abused Cisco SD-WAN zero

Securityaffairs.Co •Pierluigi Paganini • February 26, 2026

Cisco SD-WAN vulnerability CVE-2026-20127 has been exploited since 2023 to gain unauthenticated admin access. A critical Cisco SD-WAN vulnerability, tracked as CVE-2026-20127 (CVSS score of 10.0), has been actively exploited since 2023. The flaw affects Catalyst SD-WAN Controller and Manager and allows remote, unauthenticated attackers to bypass authentication and gain full administrative access by sending […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cisco SD-WAN Zero-Day Exploited by Threat Actor Since 2023 A cyber threat actor has been exploiting a zero-day vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller since 2023. This vulnerability allows unauthenticated remote attackers to bypass authentication and gain administrative privileges, potentially leading to long-term persistence in affected systems. Cisco and the Australian Cyber Security Centre have reported the ongoing exploitation of this vulnerability. 104 sources 82

Extracted Entities

CVEs (1)

CVE-2026-20127

Platforms (3)

Catalyst Sd-wan Controller Catalyst Sd-wan Manager Cisco Sd-wan