erroneo.us
Search all guides⌘K

Security Digest · Feb 25, 2026 · Vulnerability · Network edge

Cisco SD-WAN CVE-2026-20127: CVSS 10 Bypass, ED 26-03

Peering auth bypass in Cisco Catalyst SD-WAN Controller/Manager/Validator, exploited since 2023 by UAT-8616; CISA ED 26-03. Upgrade, then hunt.

Published By erroneo.us Security Desk · Updated 3 min read6 sources

Our verdict

Act now

If you run on-prem Catalyst SD-WAN control components, upgrade and hunt now: a sophisticated actor has used this bypass for years, and the follow-on SD-WAN bugs CISA keeps adding to KEV show the platform is still being targeted.

Who must act: Owners of on-prem or Cisco-hosted Catalyst SD-WAN Controller, Manager or Validator deployments, especially with ports 22/830 or the web UI reachable from untrusted networks.

Who can relax: Organizations without Cisco Catalyst SD-WAN; branch routers alone are not the vulnerable component.

Affected
Catalyst SD-WAN Controller, Manager and Validator releases earlier than 20.9 (migrate)
20.9 before 20.9.8.2
20.11 and 20.12 before 20.12.5.3/20.12.6.1
20.13 through 20.15 before 20.15.4.2
20.16 and 20.18 before 20.18.2.1
Fixed in
20.9.8.2
20.12.5.3 or 20.12.6.1
20.15.4.2
20.18.2.1
CVSS
10.0 (v3.1, vendor)
EPSS
91.8% (percentile 99.8)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Snapshot control components and collect logs before changing anything
  2. Upgrade Controller, Manager and Validator to a fixed release from Cisco's advisory
  3. Restrict ports 22 and 830 to known controller IPs and trusted hosts
  4. Hunt using the ACSC-led SD-WAN hunt guide and Talos indicators
  5. Apply Cisco's Catalyst SD-WAN hardening guide (isolate VPN 512, replace self-signed web certificate, remote syslog)
  6. Track later SD-WAN KEV entries (CVE-2026-20182, CVE-2026-76504) and patch them too

How to check if you are affected or compromised

  • Search /var/log/auth.log for 'Accepted publickey for vmanage-admin' from IPs that are not your system IPs
  • Validate every control-connection peering event against expected peer type, system IP and public IP
  • Check root and vmanage-admin authorized_keys and sshd PermitRootLogin for unauthorized changes
  • Look for unexpected software downgrades/reboots and '/../../' path traversal in usernames
  • Look for truncated or missing logs and shell histories

What happened#

On February 25, 2026, Cisco disclosed CVE-2026-20127, a broken peering-authentication mechanism in Catalyst SD-WAN Controller (formerly vSmart), Manager (vManage) and Validator (vBond). An unauthenticated remote attacker can send crafted requests, log in as an internal high-privileged non-root account, reach NETCONF and rewrite the SD-WAN fabric configuration. Cisco scored it CVSS 3.1 10.0, said no workaround exists, and credited Australia's ASD/ACSC with the report. NVD agrees on 10.0.

Exploitation was already old news to the attacker. Cisco Talos attributes the activity to UAT-8616, a "highly sophisticated" actor, with evidence going back to at least 2023. The actor reportedly downgraded the software, exploited the 2022 CLI path traversal CVE-2022-20775 to get root, then restored the original version, adding SSH keys and rogue peers and wiping logs along the way.

The same day, CISA issued Emergency Directive 26-03 plus supplemental hunt-and-harden direction, and published a joint alert with NSA and the Five Eyes cyber centers describing "ongoing global" compromise.

Who is affected#

All three control components, regardless of configuration, in on-prem, Cisco Hosted, Cisco Managed and FedRAMP deployments. Cisco says guardrails were already applied in its hosted environments; on-prem customers carry the risk themselves. Fixed releases are 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2 and 20.18.2.1. Releases before 20.9, and 20.11, 20.13, 20.14 and 20.16, must move to a different train.

Do you really need to act?#

Yes, if you operate these components. Cisco still calls exploitation "limited," but the attacker is patient and targets critical infrastructure. Owning the SD-WAN controller means owning routing policy for every branch. The story also did not end in February. According to the CISA KEV catalog, CISA added SD-WAN Manager flaws CVE-2026-20122, CVE-2026-20128 and CVE-2026-20133 on April 20, the controller bypass CVE-2026-20182 on May 14 (exploitation from mid-April, per CISA's alert), and an unauthenticated SD-WAN Manager admin bypass, CVE-2026-76504, on September 30, 2026. A February patch alone is not enough.

If you don't run Catalyst SD-WAN control infrastructure, this one is not yours.

What to do now#

  1. Before patching, take virtual snapshots and collect logs (run request admin-tech on each control component), as ED 26-03 directs. An upgrade can destroy evidence.
  2. Upgrade Controller, Manager and Validator to a fixed release, then apply fixes for the later KEV-listed SD-WAN CVEs.
  3. As an interim step for on-prem, restrict TCP 22 and 830 with ACLs or firewall rules to known controller IPs and trusted hosts.
  4. Apply Cisco's hardening guide: keep control components behind a firewall, isolate VPN 512, replace the self-signed web UI certificate, use pairwise keys, shorten session timeouts and forward logs to remote syslog.
  5. Hunt with the ACSC-led SD-WAN hunt guide linked from CISA's alert. Snort SIDs 65938 and 65958 cover exploitation.

How to tell if you were hit#

Cisco's advisory says to grep /var/log/auth.log for Accepted publickey for vmanage-admin from addresses that are not among the system IPs listed in Manager (Devices > System IP), and to validate every control-connection peering event by timestamp, peer type, system IP and public IP. Talos adds: check /home/root/.ssh/authorized_keys, /home/vmanage-admin/.ssh/authorized_keys and PermitRootLogin; look for unplanned downgrades and the message "Software upgrade not confirmed. Reverting to previous software version."; search for /../../ in usernames; and treat zero-length or truncated logs and histories as suspicious. Because the actor has been active since 2023, look back as far as your logs go.

Timeline#

  • — Earliest malicious activity Talos has found.
  • — Cisco advisory; CISA ED 26-03; CVE-2026-20127 and CVE-2022-20775 added to KEV.
  • — CVE-2026-20122, -20128 and -20133 added to KEV.
  • — CVE-2026-20182 added to KEV.
  • — CVE-2026-76504 (SD-WAN Manager) added to KEV.

Vulnerability records

  • CVE-2026-20127 · KEV 2026-02-25 · A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN…
  • CVE-2022-20775 · KEV 2026-02-25 · A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.
  • CVE-2026-20182 · KEV 2026-05-14 · May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Cisco — Catalyst SD-WAN Controller Authentication Bypass Vulnerability (cisco-sa-sdwan-rpa-EHchtZk) sec.cloudapps.cisco.com
  2. CISA — Immediate Action Required: CISA Issues Emergency Directive to Secure Cisco SD-WAN Systems cisa.gov
  3. CISA — CISA and Partners Release Guidance for Ongoing Global Exploitation of Cisco SD-WAN Systems cisa.gov
  4. Cisco Talos — UAT-8616 targeting Cisco SD-WAN blog.talosintelligence.com
  5. NVD — CVE-2026-20127 nvd.nist.gov
  6. CISA — Known Exploited Vulnerabilities catalog (JSON feed) cisa.gov