---
title: "Cisco SD-WAN CVE-2026-20127: CVSS 10 Bypass, ED 26-03"
url: https://erroneo.us/security/briefs/cisco-catalyst-sd-wan-cve-2026-20127-auth-bypass/
description: "Peering auth bypass in Cisco Catalyst SD-WAN Controller/Manager/Validator, exploited since 2023 by UAT-8616; CISA ED 26-03. Upgrade, then hunt."
type: security-brief
section: "Security Digest"
date_published: 2026-02-25
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-20127", "CVE-2022-20775", "CVE-2026-20182"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco SD-WAN CVE-2026-20127: CVSS 10 Bypass, ED 26-03

**Verdict: Act now.** If you run on-prem Catalyst SD-WAN control components, upgrade and hunt now: a sophisticated actor has used this bypass for years, and the follow-on SD-WAN bugs CISA keeps adding to KEV show the platform is still being targeted.

- **Who must act:** Owners of on-prem or Cisco-hosted Catalyst SD-WAN Controller, Manager or Validator deployments, especially with ports 22/830 or the web UI reachable from untrusted networks.
- **Who can relax:** Organizations without Cisco Catalyst SD-WAN; branch routers alone are not the vulnerable component.
- **Affected:** Catalyst SD-WAN Controller, Manager and Validator releases earlier than 20.9 (migrate); 20.9 before 20.9.8.2; 20.11 and 20.12 before 20.12.5.3/20.12.6.1; 20.13 through 20.15 before 20.15.4.2; 20.16 and 20.18 before 20.18.2.1
- **Fixed:** 20.9.8.2; 20.12.5.3 or 20.12.6.1; 20.15.4.2; 20.18.2.1
- **CVEs:** CVE-2026-20127, CVE-2022-20775, CVE-2026-20182
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Snapshot control components and collect logs before changing anything
2. Upgrade Controller, Manager and Validator to a fixed release from Cisco's advisory
3. Restrict ports 22 and 830 to known controller IPs and trusted hosts
4. Hunt using the ACSC-led SD-WAN hunt guide and Talos indicators
5. Apply Cisco's Catalyst SD-WAN hardening guide (isolate VPN 512, replace self-signed web certificate, remote syslog)
6. Track later SD-WAN KEV entries (CVE-2026-20182, CVE-2026-76504) and patch them too

### How to check if you are affected

- Search /var/log/auth.log for 'Accepted publickey for vmanage-admin' from IPs that are not your system IPs
- Validate every control-connection peering event against expected peer type, system IP and public IP
- Check root and vmanage-admin authorized_keys and sshd PermitRootLogin for unauthorized changes
- Look for unexpected software downgrades/reboots and '/../../' path traversal in usernames
- Look for truncated or missing logs and shell histories

## What happened

On February 25, 2026, Cisco disclosed [CVE-2026-20127](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk), a broken peering-authentication mechanism in Catalyst SD-WAN Controller (formerly vSmart), Manager (vManage) and Validator (vBond). An unauthenticated remote attacker can send crafted requests, log in as an internal high-privileged non-root account, reach NETCONF and rewrite the SD-WAN fabric configuration. Cisco scored it CVSS 3.1 10.0, said no workaround exists, and credited Australia's ASD/ACSC with the report. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-20127) agrees on 10.0.

Exploitation was already old news to the attacker. [Cisco Talos](https://blog.talosintelligence.com/uat-8616-sd-wan/) attributes the activity to UAT-8616, a "highly sophisticated" actor, with evidence going back to at least 2023. The actor reportedly downgraded the software, exploited the 2022 CLI path traversal CVE-2022-20775 to get root, then restored the original version, adding SSH keys and rogue peers and wiping logs along the way.

The same day, CISA issued [Emergency Directive 26-03](https://www.cisa.gov/news-events/news/immediate-action-required-cisa-issues-emergency-directive-secure-cisco-sd-wan-systems) plus supplemental hunt-and-harden direction, and published a [joint alert](https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-and-partners-release-guidance-ongoing-global-exploitation-cisco-sd-wan-systems) with NSA and the Five Eyes cyber centers describing "ongoing global" compromise.

## Who is affected

All three control components, regardless of configuration, in on-prem, Cisco Hosted, Cisco Managed and FedRAMP deployments. Cisco says guardrails were already applied in its hosted environments; on-prem customers carry the risk themselves. Fixed releases are 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2 and 20.18.2.1. Releases before 20.9, and 20.11, 20.13, 20.14 and 20.16, must move to a different train.

## Do you really need to act?

Yes, if you operate these components. Cisco still calls exploitation "limited," but the attacker is patient and targets critical infrastructure. Owning the SD-WAN controller means owning routing policy for every branch. The story also did not end in February. According to the [CISA KEV catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json), CISA added SD-WAN Manager flaws CVE-2026-20122, CVE-2026-20128 and CVE-2026-20133 on April 20, the controller bypass CVE-2026-20182 on May 14 (exploitation from mid-April, per CISA's alert), and an unauthenticated SD-WAN Manager admin bypass, CVE-2026-76504, on September 30, 2026. A February patch alone is not enough.

If you don't run Catalyst SD-WAN control infrastructure, this one is not yours.

## What to do now

1. Before patching, take virtual snapshots and collect logs (run `request admin-tech` on each control component), as ED 26-03 directs. An upgrade can destroy evidence.
2. Upgrade Controller, Manager and Validator to a fixed release, then apply fixes for the later KEV-listed SD-WAN CVEs.
3. As an interim step for on-prem, restrict TCP 22 and 830 with ACLs or firewall rules to known controller IPs and trusted hosts.
4. Apply Cisco's hardening guide: keep control components behind a firewall, isolate VPN 512, replace the self-signed web UI certificate, use pairwise keys, shorten session timeouts and forward logs to remote syslog.
5. Hunt with the ACSC-led SD-WAN hunt guide linked from CISA's alert. Snort SIDs 65938 and 65958 cover exploitation.

## How to tell if you were hit

Cisco's advisory says to grep `/var/log/auth.log` for `Accepted publickey for vmanage-admin` from addresses that are not among the system IPs listed in Manager (Devices > System IP), and to validate every control-connection peering event by timestamp, peer type, system IP and public IP. Talos adds: check `/home/root/.ssh/authorized_keys`, `/home/vmanage-admin/.ssh/authorized_keys` and `PermitRootLogin`; look for unplanned downgrades and the message "Software upgrade not confirmed. Reverting to previous software version."; search for `/../../` in usernames; and treat zero-length or truncated logs and histories as suspicious. Because the actor has been active since 2023, look back as far as your logs go.

## Timeline

- 2023 — Earliest malicious activity Talos has found.
- Feb 25, 2026 — Cisco advisory; CISA ED 26-03; CVE-2026-20127 and CVE-2022-20775 added to KEV.
- Apr 20, 2026 — CVE-2026-20122, -20128 and -20133 added to KEV.
- May 14, 2026 — CVE-2026-20182 added to KEV.
- Sep 30, 2026 — CVE-2026-76504 (SD-WAN Manager) added to KEV.

## Sources

1. [Cisco — Catalyst SD-WAN Controller Authentication Bypass Vulnerability (cisco-sa-sdwan-rpa-EHchtZk)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)
2. [CISA — Immediate Action Required: CISA Issues Emergency Directive to Secure Cisco SD-WAN Systems](https://www.cisa.gov/news-events/news/immediate-action-required-cisa-issues-emergency-directive-secure-cisco-sd-wan-systems)
3. [CISA — CISA and Partners Release Guidance for Ongoing Global Exploitation of Cisco SD-WAN Systems](https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-and-partners-release-guidance-ongoing-global-exploitation-cisco-sd-wan-systems)
4. [Cisco Talos — UAT-8616 targeting Cisco SD-WAN](https://blog.talosintelligence.com/uat-8616-sd-wan/)
5. [NVD — CVE-2026-20127](https://nvd.nist.gov/vuln/detail/CVE-2026-20127)
6. [CISA — Known Exploited Vulnerabilities catalog (JSON feed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

---
Source page: https://erroneo.us/security/briefs/cisco-catalyst-sd-wan-cve-2026-20127-auth-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt