1. Home
  2. Vulnerabilities
  3. CVE-2026-20127
Known Exploited Vulnerability
10.0
CRITICAL CVSS 3.1
CVE-2026-20127
Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability - [Actively Exploited]
Description

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. 

INFO

Published Date :

Feb. 25, 2026, 5:25 p.m.

Last Modified :

Feb. 26, 2026, 4:20 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

Required Action :

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Known Ransomware Campaign Use:

Unknown

Notes :

CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20127

Affected Products

The following products are affected by CVE-2026-20127 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Cisco catalyst_sd-wan_manager
2 Cisco sd-wan_vsmart_controller
: Total Affected Vendor : 1 | Products : 2
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL [email protected]
CVSS 3.1 CRITICAL [email protected]
Solution
Address a peering authentication bypass vulnerability to prevent unauthorized administrative access and configuration manipulation.
  • Apply vendor-supplied security updates for Cisco Catalyst SD-WAN.
  • Implement strict access controls for network management interfaces.
  • Monitor systems for suspicious authentication attempts.
  • Review and restrict NETCONF access privileges.
Public PoC/Exploit Available at Github

CVE-2026-20127 has a 7 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-20127.

URL Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127 US Government Resource
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-20127 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-20127 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
Dimchuk/CVE-2026-20127-chain

None

Updated: 11 hours, 53 minutes ago
0 stars 0 fork 0 watcher
Born at : Feb. 26, 2026, 3:49 p.m. This repo has been linked 2 different CVEs too.
Profile Photo
nbajpai-code/tn

tech news

Python

Updated: 19 hours, 9 minutes ago
0 stars 0 fork 0 watcher
Born at : Dec. 3, 2025, 12:31 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
CryptoGenNepal/CVE-KEV-RSS

CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild and CryptoGen Nepal aims to simplify this for the general public in a more understandable way as well as in a format that can be easily integrated into their threat intelligence systems.

cve json rss cgn cisa kev

Python HTML

Updated: 17 hours, 27 minutes ago
5 stars 4 fork 4 watcher
Born at : Feb. 16, 2025, 5:21 p.m. This repo has been linked 2 different CVEs too.
Profile Photo
ScottyxNova/QMasters-TIA

None

PowerShell Shell

Updated: 4 hours, 24 minutes ago
1 stars 0 fork 0 watcher
Born at : Dec. 30, 2024, 12:41 p.m. This repo has been linked 4 different CVEs too.
Profile Photo
DevGreick/devgreick

None

Python

Updated: 5 hours, 36 minutes ago
1 stars 0 fork 0 watcher
Born at : Oct. 29, 2024, 8:10 p.m. This repo has been linked 10 different CVEs too.
Profile Photo
Century300/Century300

None

Updated: 21 hours, 6 minutes ago
0 stars 0 fork 0 watcher
Born at : Dec. 26, 2021, 5:54 a.m. This repo has been linked 2 different CVEs too.
Profile Photo
nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 9 hours, 11 minutes ago
7546 stars 1241 fork 1241 watcher
Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 757 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-20127 vulnerability anywhere in the article.

  • The Register
Five Eyes warn: Patch your Cisco SD-WAN or risk root takeover

The Five Eyes intelligence alliance is urgently warning defenders to patch two Cisco Catalyst SD-WAN vulnerabilities used in attacks. First discovered by the Australian Signals Directorate (ASD), all ... Read more

Published Date: Feb 26, 2026 (16 hours, 21 minutes ago)
  • security.nl
NCSC verwacht grootschalig misbruik van kritiek Cisco-lek: 'patch zo snel mogelijk'

Het Nationaal Cyber Security Centrum (NCSC) verwacht grootschalig misbruik van een kritieke kwetsbaarheid in Cisco Catalyst SD-WAN Controller en Cisco Catalyst SD-WAN Manager en roept organisaties op ... Read more

Published Date: Feb 26, 2026 (19 hours, 5 minutes ago)
  • The Cyber Express
Hackers Exploited Cisco SD-WAN Zero-Day for Three Years Before Detection

Cisco Talos disclosed that a highly sophisticated threat actor exploited a critical authentication bypass vulnerability in Cisco SD-WAN infrastructure for at least three years before security research ... Read more

Published Date: Feb 26, 2026 (20 hours, 29 minutes ago)
  • The Hacker News
Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited Since 2023 for Admin Access

A newly disclosed maximum-severity security flaw in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Catalyst SD-WAN Manager (formerly vManage) has come under active exploitation in the wild as ... Read more

Published Date: Feb 26, 2026 (21 hours, 48 minutes ago)
  • Daily CyberSecurity
The Three-Year Shadow: Critical CVSS 10 Cisco SD-WAN Zero-Day Exploited by UAT-8616

Cisco Talos has issued a high-alert warning regarding the active exploitation of CVE-2026-20127, a critical vulnerability affecting the Cisco Catalyst SD-WAN Controller. This CVSS 10 vulnerability all ... Read more

Published Date: Feb 26, 2026 (1 day, 1 hour ago)
  • CybersecurityNews
Critical Cisco SD-WAN 0-Day Vulnerability Exploited Since 2023 to Gain Root Access

Cisco SD-WAN 0-Day Vulnerability Cisco has disclosed a critical zero-day vulnerability in its Catalyst SD-WAN products that threat actors have exploited since 2023 to bypass authentication and achieve ... Read more

Published Date: Feb 26, 2026 (1 day, 2 hours ago)
  • Help Net Security
Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127)

A “highly sophisticated” cyber threat actor has been exploiting a zero-day authentication bypass vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller (formerly vSmart), Cisco has announc ... Read more

Published Date: Feb 25, 2026 (1 day, 11 hours ago)
  • security.nl
'Organisaties wereldwijd aangevallen via kritiek lek in Cisco Catalyst SD-WAN'

Organisaties wereldwijd zijn aangevallen via een kritieke kwetsbaarheid in de Cisco Catalyst SD-WAN Controller, zo waarschuwen de Amerikaanse geheime dienst NSA, alsmede andere overheidsinstanties uit ... Read more

Published Date: Feb 25, 2026 (1 day, 11 hours ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-20127 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Feb. 26, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    Added CWE CWE-287
    Added CPE Configuration OR *cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* versions up to (excluding) 20.9.8.2 *cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* versions from (including) 20.11 up to (excluding) 20.12.5.3 *cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* versions from (including) 20.13 up to (excluding) 20.15.4.2 *cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* versions from (including) 20.16 up to (excluding) 20.18.2.1 *cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:* *cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* versions up to (excluding) 20.9.8.2 *cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* versions from (including) 20.11 up to (excluding) 20.12.5.3 *cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* versions from (including) 20.13 up to (excluding) 20.15.4.2 *cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* versions from (including) 20.16 up to (excluding) 20.18.2.1 *cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.12.6:*:*:*:*:*:*:*
    Added Reference Type Cisco Systems, Inc.: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk Types: Vendor Advisory
    Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127 Types: US Government Resource
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Feb. 25, 2026

    Action Type Old Value New Value
    Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127
  • New CVE Received by [email protected]

    Feb. 25, 2026

    Action Type Old Value New Value
    Added Description A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. 
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    Added CWE CWE-287
    Added Reference https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 10.0
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact