CVE-2026-20127

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-20127 10.0

Cisco · Catalyst SD-WAN Controller and Manager · Added 2026-02-25 · Published 2026-02-25

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityCisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

VendorCisco

ProductCatalyst SD-WAN Controller and Manager

Date added2026-02-25

Due date2026-02-27

CISA catalogView on CISA KEV catalog

Required actionPlease adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

CWECWE-287

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

NVD: A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-06-16 22:03 UTC

Wall time30.0s

Searches5

Component defaultyes

Sources https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
https://blog.talosintelligence.com/uat-8616-sd-wan/
https://www.rapid7.com/blog/post/etr-critical-cisco-catalyst-vulnerability-exploited-in-the-wild-cve-2026-20127/
https://www.penligent.ai/hackinglabs/cve-2026-20127-poc-what-we-know-what-we-dont-and-what-you-should-do-today/
https://nvd.nist.gov/vuln/detail/CVE-2026-20127

Hunting hypothesis agent

Monitor for unauthenticated network attempts to bypass peering authentication in Cisco Catalyst SD-WAN Controller and Manager, granting remote administrative access.

Research details

ComponentPeering authentication mechanism in the vdaemon networking stack (control plane)

PreconditionsNetwork reachability to the affected SD-WAN Controller, Manager, or Validator control plane interface on ports used for peering (TCP/8443 and related); no authentication barrier; target must run a vulnerable version of Cisco Catalyst SD-WAN Controller (vSmart), Manager (vManage), or Validator (vBond) with the peering authentication service exposed and accessible agent

DeliveryCrafted network requests to the peering authentication endpoint of the affected SD-WAN control plane

Public PoCno

Advisoryhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Actively exploited by UAT-8616 per Cisco Talos; CISA ED 26-03 (3-day forensic triage)

SummaryCVE-2026-20127 is a critical authentication bypass vulnerability in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller (vSmart), Manager (vManage), and Validator (vBond). The flaw allows an unauthenticated, remote attacker to bypass peering authentication and gain administrative privileges as the internal vmanage-admin non-root user. From there, the attacker can access NETCONF to manipulate SD-WAN fabric configuration. Cisco Talos tracks active exploitation by threat actor UAT-8616. The attack chain involves: (1) exploiting the peering auth bypass to inject a rogue peer, (2) injecting SSH authorized keys for the vmanage-admin account, (3) accessing NETCONF for configuration manipulation, (4) downgrading firmware and exploiting CVE-2022-20775 for privilege escalation to root. Fixed versions: 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2, 20.18.2.1.

Tia coverage

First reported2026-06-05

First exploit report2026-06-05

Exploit report → KEV100 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisco-sd-wan-manager-auth-bypass-cve-2026-76504-cvss-9-8-under-e

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.