CVE-2026-20127

10.0

CRITICAL CVSS 3.1

Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability - [Actively Exploited]

Overview

Description

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. 

Details

INFO

Published Date :

Feb. 25, 2026, 5:25 p.m.

Last Modified :

Feb. 26, 2026, 4:20 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Feb 27, 2026

Alert Date: Feb 25, 2026 | 23 days ago

Description :

Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

Required Action :

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Known Ransomware Campaign Use:

Unknown

Notes :

CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20127

Impact

Affected Products

The following products are affected by CVE-2026-20127 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Cisco	catalyst_sd-wan_manager
2	Cisco	sd-wan_vsmart_controller

: Total Affected Vendor : 1 | Products : 2

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]
	CVSS 3.1	CRITICAL				[email protected]

Solution

Address a peering authentication bypass vulnerability to prevent unauthorized administrative access and configuration manipulation.

Apply vendor-supplied security updates for Cisco Catalyst SD-WAN.
Implement strict access controls for network management interfaces.
Monitor systems for suspicious authentication attempts.
Review and restrict NETCONF access privileges.

Public PoC/Exploit Available at Github

CVE-2026-20127 has a 16 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-20127.

URL	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-20127 is associated with the following CWEs:

CWE-287: Improper Authentication

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-20127 weaknesses.

CAPEC-22: Exploiting Trust in Client Exploiting Trust in Client CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data Utilizing REST's Trust in the System Resource to Obtain Sensitive Data CAPEC-94: Adversary in the Middle (AiTM) Adversary in the Middle (AiTM) CAPEC-114: Authentication Abuse Authentication Abuse CAPEC-115: Authentication Bypass Authentication Bypass CAPEC-151: Identity Spoofing Identity Spoofing CAPEC-194: Fake the Source of Data Fake the Source of Data CAPEC-593: Session Hijacking Session Hijacking CAPEC-633: Token Impersonation Token Impersonation CAPEC-650: Upload a Web Shell to a Web Server Upload a Web Shell to a Web Server

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

sfewer-r7/CVE-2026-20127

An exploit for the Cisco Catalyst SD-WAN Controller authentication bypass vulnerability, CVE-2026-20127

Ruby

Updated: 6 days, 17 hours ago

18 stars 1 fork 1 watcher

Born at : March 9, 2026, 2:38 p.m. This repo has been linked 1 different CVEs too.

abrahamsurf/sdwan-scanner-CVE-2026-20127

Cisco SD-WAN Exposure & Potential Vulnerability Scanner (Passive Fingerprinting) 2026

Python

Updated: 1 week, 4 days ago

0 stars 0 fork 0 watcher

Born at : March 8, 2026, 9:04 a.m. This repo has been linked 1 different CVEs too.

yonathanpy/CVE-2026-20127-Cisco-SD-WAN-Preauth-RCE

None

Python Java

Updated: 1 week, 5 days ago

1 stars 0 fork 0 watcher

Born at : March 7, 2026, 9:39 a.m. This repo has been linked 1 different CVEs too.

BugFor-Pings/CVE-2026-20127_EXP

Cisco Catalyst SD-WAN 身份验证绕过漏洞(CVE-2026-20127)利用EXP

Java Python

Updated: 1 week, 4 days ago

3 stars 2 fork 2 watcher

Born at : March 5, 2026, 3:28 p.m. This repo has been linked 1 different CVEs too.

leemuun/CVE-2026-20127

CVE-2026‑20127 – Remote Authentication Bypass for Cisco Catalyst SD‑WAN

cve-2026-20127 cisco-sd-wan-rce cisco

Python Java

Updated: 2 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : March 5, 2026, 2:40 a.m. This repo has been linked 1 different CVEs too.

zerozenxlabs/CVE-2026-20127---Cisco-SD-WAN-Preauth-RCE

None

Python Java

Updated: 1 week, 2 days ago

27 stars 9 fork 9 watcher

Born at : March 4, 2026, 1:20 a.m. This repo has been linked 1 different CVEs too.

KulbirJ/cyber-risk-ml-training

None

Python

Updated: 1 week, 5 days ago

1 stars 0 fork 0 watcher

Born at : March 3, 2026, 8:39 p.m. This repo has been linked 4 different CVEs too.

prompted365/redshit

None

Rust Python

Updated: 2 weeks, 4 days ago

0 stars 0 fork 0 watcher

Born at : March 1, 2026, 3:54 p.m. This repo has been linked 3 different CVEs too.

PyramidOfPain/CISA-ED-26-03

None

Shell

Updated: 2 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 27, 2026, 2:27 p.m. This repo has been linked 4 different CVEs too.

ikdrn/Trend_idea

None

Python Shell TypeScript JavaScript Go Rust HTML

Updated: 17 hours, 21 minutes ago

1 stars 0 fork 0 watcher

Born at : Feb. 27, 2026, 4:59 a.m. This repo has been linked 2 different CVEs too.

bluefalconink/cisa-ed-26-03-tracker

BlueFalconInk CISA ED 26-03 Compliance Tracker - Rapid-response Streamlit app for Cisco SD-WAN vulnerability mitigation (CVE-2026-20127, CVE-2022-20775)

Dockerfile Python

Updated: 2 weeks, 5 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 27, 2026, 12:26 a.m. This repo has been linked 2 different CVEs too.

Dimchuk/CVE-2026-20127-chain

None

Updated: 2 weeks, 5 days ago

5 stars 0 fork 0 watcher

Born at : Feb. 26, 2026, 3:49 p.m. This repo has been linked 2 different CVEs too.

uls0/Active-Defense-Hell

Honeypot with counter-attack and IA to deliver better payloads

Python Dockerfile HTML JavaScript Shell

Updated: 2 weeks ago

0 stars 0 fork 0 watcher

Born at : Feb. 23, 2026, 4:17 p.m. This repo has been linked 1 different CVEs too.

Threekiii/CVE

一个 CVE 漏洞预警知识库，无 exp/poc，部分包含修复方案。A knowledge base of CVE security vulnerability, no PoCs/exploits.

Updated: 1 day, 22 hours ago

161 stars 23 fork 23 watcher

Born at : Jan. 5, 2023, 2:19 a.m. This repo has been linked 238 different CVEs too.

GhostTroops/TOP

TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things

bugbounty cve exp exploit payload poc rce vulnerability

Shell

Updated: 2 days, 6 hours ago

720 stars 124 fork 124 watcher

Born at : March 19, 2022, 1:54 a.m. This repo has been linked 286 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-20127 vulnerability anywhere in the article.

Hackread - Cybersecurity News, Data Breaches, AI and More

US Agencies Face CISA Deadline Over Critical Cisco SD-WAN Flaw

US government departments are facing a major deadline in a high-stakes effort to reclaim their networks from intruders who have been hiding in the system for years. This intensive cleanup follows the ...

Published Date: Mar 13, 2026 (6 days, 20 hours ago)

security.nl

Amerikaanse overheid moet Cisco SD-WAN-logs met cyberagentschap delen

Amerikaanse overheidsinstanties moeten de logs van hun Cisco SD-WAN-systemen met het Amerikaanse cyberagentschap CISA delen. Het CISA heeft hiervoor een nieuw noodbevel afgegeven. Aanleiding is actief ...

Published Date: Mar 11, 2026 (1 week, 1 day ago)

security.nl

Securitybedrijf meldt grootschalig misbruik van kritiek Cisco SD-WAN-lek

Aanvallers maken op grote schaal misbruik van een kritieke kwetsbaarheid in Cisco Catalyst SD-WAN Controller, zo stelt securitybedrijf WatchTowr. Onlangs liet het Nationaal Cyber Security Centrum (NCS ...

Published Date: Mar 09, 2026 (1 week, 3 days ago)

The Hacker News

OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High-Severity Issues

OpenAI on Friday began rolling out Codex Security, an artificial intelligence (AI)-powered security agent that's designed to find, validate, and propose fixes for vulnerabilities. The feature is avail ...

Published Date: Mar 07, 2026 (1 week, 5 days ago)

The Hacker News

Anthropic Finds 22 Firefox Vulnerabilities Using Claude Opus 4.6 AI Model

Anthropic on Friday said it discovered 22 new security vulnerabilities in the Firefox web browser as part of a security partnership with Mozilla. Of these, 14 have been classified as high, seven have ...

Published Date: Mar 07, 2026 (1 week, 5 days ago)

TheCyberThrone

Cisco Catalyst SD-WAN — Active Exploitation Alert

March 7, 2026What HappenedCisco released security patches on February 25 for five Catalyst SD-WAN vulnerabilities. On March 5, the company updated its advisory to warn that two of them — CVE-2026-2012 ...

Published Date: Mar 07, 2026 (1 week, 6 days ago)

The Register

Cisco warns of two more SD-WAN bugs under active attack

Just when network admins thought the Cisco SD-WAN patch queue might finally be shrinking, Switchzilla has confirmed miscreants are exploiting more vulnerabilities in its SD-WAN management software. Th ...

Published Date: Mar 06, 2026 (1 week, 6 days ago)

The Hacker News

Iran-Linked MuddyWater Hackers Target U.S. Networks With New Dindoor Backdoor

New research from Broadcom's Symantec and Carbon Black Threat Hunter Team has discovered evidence of an Iranian hacking group embedding itself in several U.S. companies' networks, including banks, air ...

Published Date: Mar 06, 2026 (1 week, 6 days ago)

The Hacker News

Hikvision and Rockwell Automation CVSS 9.8 Flaws Added to CISA KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Hikvision and Rockwell Automation products to its Known Exploited Vulnerabilities (KEV) ...

Published Date: Mar 06, 2026 (2 weeks ago)

CybersecurityNews

PoC Exploit Released Cisco SD-WAN 0-Day Vulnerability Exploited in the Wild

PoC Exploit Released Cisco SD-WAN 0-Day Vulnerability A public proof-of-concept (PoC) exploit has been released for CVE-2026-20127, a maximum-severity zero-day vulnerability in Cisco Catalyst SD-WAN C ...

Published Date: Mar 06, 2026 (2 weeks ago)

The Hacker News

Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities

Cisco has disclosed that two more vulnerabilities affecting Catalyst SD-WAN Manager (formerly SD-WAN vManage) have come under active exploitation in the wild. The vulnerabilities in question are liste ...