CVE-2026-20127: Cisco Catalyst SD-WAN auth bypass in peering authentication

CVE-2026-20127 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-02-25

A critical vulnerability in Cisco's SD-WAN management software allows unauthorized individuals to bypass security checks and gain administrative control over the network. Cisco Catalyst SD-WAN is used by organizations to manage and secure large-scale corporate networks. An attacker exploiting this flaw could remotely log into the system, change network configurations, and potentially disrupt all communications across the business infrastructure.

Technologies: Cisco Catalyst SD-WAN Manager. Vendors: Cisco.

Quick answers

Is CVE-2026-20127 exploited in the wild?
Yes. CVE-2026-20127 is known to be exploited in the wild, first recorded on 25 February 2026. Treat it as urgent.
How severe is CVE-2026-20127?
Critical severity, with a CVSS score of 10, published 25 February 2026.
Which products and versions are affected?
Cisco Catalyst SD-WAN Controller < 20.9.8.2, 20.11 < 20.12.5.3, 20.13 < 20.15.4.2, 20.16 < 20.18.2.1; Cisco Catalyst SD-WAN Controller (vSmart) All versions prior to 20.9.8.2, 20.12.5.3, 20.15.4.2, 20.18.2.1; Cisco Catalyst SD-WAN Manager < 20.9.8.2, 20.11 < 20.12.5.3, 20.13 < 20.15.4.2, 20.16 < 20.18.2.1; Cisco Catalyst SD-WAN Manager (vManage) All versions prior to 20.9.8.2, 20.12.5.3, 20.15.4.2, 20.18.2.1; and 1 more.
Is there a fix for CVE-2026-20127?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20127 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20127?
Check whether you run Cisco Catalyst SD-WAN Controller, Cisco Catalyst SD-WAN Controller (vSmart), Cisco Catalyst SD-WAN Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability (CWE-287) stems from a failure in the peering authentication mechanism used between Cisco Catalyst SD-WAN Controllers, Managers, and Validators. An unauthenticated remote attacker can exploit this by sending crafted requests to the affected system's peering interface. Successful exploitation grants access as a high-privileged, non-root internal user account. From this position, the attacker can access the NETCONF interface to manipulate the network configuration of the entire SD-WAN fabric. Cisco has released software updates to address the issue, and CISA has added this to the Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation.

Affected products

  • Cisco Catalyst SD-WAN Controller (vSmart) All versions prior to 20.9.8.2, 20.12.5.3, 20.15.4.2, 20.18.2.1
  • Cisco Catalyst SD-WAN Manager (vManage) All versions prior to 20.9.8.2, 20.12.5.3, 20.15.4.2, 20.18.2.1
  • Cisco Catalyst SD-WAN Validator (vBond) All versions prior to 20.9.8.2, 20.12.5.3, 20.15.4.2, 20.18.2.1

Timeline

  • 2026-02-25: advisory: Initial advisory published by Cisco
  • 2026-02-25: kev added: CISA added to Known Exploited Vulnerabilities catalog
  • 2026-06-16: other: Advisory updated to include Catalyst SD-WAN Validator (vBond)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.