CVE-2025-20127

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

February 26, 2026

Last Seen

February 26, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Cisco SD-WAN Zero-Day Exploited by Threat Actor Since 202382.1

A cyber threat actor has been exploiting a zero-day vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller since 2023. This vulnerability allows unauthenticated remote attackers to bypass authentication and gain administrative privileges, potentially leading to long-term persistence in a...