# CVE-2026-20127: Cisco Catalyst SD-WAN auth bypass in peering authentication

Source: https://junglewise.ai/threats/cve-2026-20127-cisco-catalyst-sd-wan-auth-bypass-in-peering-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-25. Updated: 2026-06-16  
License: CC BY 4.0 with a link back

CVE-2026-20127 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-02-25

A critical vulnerability in Cisco's SD-WAN management software allows unauthorized individuals to bypass security checks and gain administrative control over the network. Cisco Catalyst SD-WAN is used by organizations to manage and secure large-scale corporate networks. An attacker exploiting this flaw could remotely log into the system, change network configurations, and potentially disrupt all communications across the business infrastructure.

Technologies: [Cisco Catalyst SD-WAN Manager](https://junglewise.ai/threats/technologies/catalyst-sd-wan-manager). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20127 exploited in the wild?** Yes. CVE-2026-20127 is known to be exploited in the wild, first recorded on 25 February 2026. Treat it as urgent.

**How severe is CVE-2026-20127?** Critical severity, with a CVSS score of 10, published 25 February 2026.

**Which products and versions are affected?** Cisco Catalyst SD-WAN Controller < 20.9.8.2, 20.11 < 20.12.5.3, 20.13 < 20.15.4.2, 20.16 < 20.18.2.1; Cisco Catalyst SD-WAN Controller (vSmart) All versions prior to 20.9.8.2, 20.12.5.3, 20.15.4.2, 20.18.2.1; Cisco Catalyst SD-WAN Manager < 20.9.8.2, 20.11 < 20.12.5.3, 20.13 < 20.15.4.2, 20.16 < 20.18.2.1; Cisco Catalyst SD-WAN Manager (vManage) All versions prior to 20.9.8.2, 20.12.5.3, 20.15.4.2, 20.18.2.1; and 1 more.

**Is there a fix for CVE-2026-20127?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20127 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20127?** Check whether you run Cisco Catalyst SD-WAN Controller, Cisco Catalyst SD-WAN Controller (vSmart), Cisco Catalyst SD-WAN Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability (CWE-287) stems from a failure in the peering authentication mechanism used between Cisco Catalyst SD-WAN Controllers, Managers, and Validators. An unauthenticated remote attacker can exploit this by sending crafted requests to the affected system's peering interface. Successful exploitation grants access as a high-privileged, non-root internal user account. From this position, the attacker can access the NETCONF interface to manipulate the network configuration of the entire SD-WAN fabric. Cisco has released software updates to address the issue, and CISA has added this to the Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation.

## Affected products

- Cisco Catalyst SD-WAN Controller (vSmart) All versions prior to 20.9.8.2, 20.12.5.3, 20.15.4.2, 20.18.2.1
- Cisco Catalyst SD-WAN Manager (vManage) All versions prior to 20.9.8.2, 20.12.5.3, 20.15.4.2, 20.18.2.1
- Cisco Catalyst SD-WAN Validator (vBond) All versions prior to 20.9.8.2, 20.12.5.3, 20.15.4.2, 20.18.2.1

## Timeline

- 2026-02-25: advisory: Initial advisory published by Cisco
- 2026-02-25: kev added: CISA added to Known Exploited Vulnerabilities catalog
- 2026-06-16: other: Advisory updated to include Catalyst SD-WAN Validator (vBond)

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)

## Related threats

- [Cisco Catalyst SD-WAN Manager API authentication bypass](https://junglewise.ai/threats/cve-2026-76504-a-vulnerability-in-the-api-session-based-authentication)
- [Cisco Catalyst SD-WAN Manager information disclosure in web interface](https://junglewise.ai/threats/cve-2026-20294-cisco-catalyst-sd-wan-manager-information-disclosure-in-web)
- [Cisco Catalyst SD-WAN Manager arbitrary file write in web UI](https://junglewise.ai/threats/cve-2026-20262-cisco-catalyst-sd-wan-manager-arbitrary-file-write-in-web-ui)
- [Cisco Catalyst SD-WAN Manager privilege escalation in CLI](https://junglewise.ai/threats/cve-2026-20245-cisco-catalyst-sd-wan-manager-privilege-escalation-in-cli)
- [Cisco Catalyst SD-WAN Manager XXE in web UI](https://junglewise.ai/threats/cve-2026-20224-cisco-catalyst-sd-wan-manager-xxe-in-web-ui)