Multiple vulnerabilities have been discovered in Cisco Catalyst SD-WAN products, the most severe of which could allow for authentication bypass. Cisco Catalyst SD-WAN (formerly Viptela) is a secure, cloud-delivered software-defined WAN architecture that optimizes application performance by intelligently routing traffic over any combination of transport links (MPLS, broadband, LTE). Successful exploitation of the most severe of these vulnerabilities could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20127 and CVE-2022-20775 to its Known Exploited Vulnerabilities (KEV) Catalog on Feb. 25, 2026. CISA and partners have observed malicious cyber actors targeting and compromising Cisco SD-WAN systems of organizations, globally. These actors have also been observed exploiting a previously undisclosed authentication bypass vulnerability, CVE-2026-20127, for initial access before escalating privileges using CVE-2022-20775 and establishing long-term persistence in Cisco SD-WAN systems.
Tactic : Initial Access ( TA0001 ):
Technique : Exploit Public-Facing Application ( T1190 ):
Successful exploitation of the most severe of these vulnerabilities could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
We recommend the following actions be taken:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
