Critical Cisco SD-WAN Zero-Day Exploited Since 2023
February 3rd, 2026
❓What:
A critical authentication bypass vulnerability (CVE-2026-20127) affecting Cisco Catalyst SD-WAN Controller and SD-WAN Manager allows a remote attacker to bypass authentication and obtain high-privileged access to affected systems.
The flaw stems from a failure in the SD-WAN peering authentication mechanism, enabling attackers to send crafted requests that grant privileged access.
The vulnerability carries a CVSS score of 10.0 and has been actively exploited since at least 2023 by a sophisticated threat actor tracked as UAT-8616.
Once access is obtained, attackers can use the NETCONF interface to manipulate network configurations across the SD-WAN fabric.
⚠️Impact:
Successful exploitation can give attackers control of the SD-WAN management and control plane, allowing them to alter routing, policies, and connectivity across the entire network fabric.
Potential consequences include:
Unauthorized network configuration changes
Insertion of rogue peers/devices into the SD-WAN fabric
Privilege escalation to root access
Persistent access to critical networking infrastructure
Systems with internet-exposed management interfaces are at the highest risk.
💡Recommendations:
Organizations running Cisco Catalyst SD-WAN should take immediate defensive actions:
1. Patch immediately
Upgrade to Cisco fixed versions addressing CVE-2026-20127.
2. Restrict management access
Remove public exposure of SD-WAN management interfaces.
Limit access to trusted admin networks via VPN/jump hosts.
3. Hunt for indicators of compromise
Review authentication logs (e.g., /var/log/auth.log) for unknown IP addresses or unusual admin logins.
Investigate unexpected SD-WAN peering connections or configuration changes.
4. Harden the management plane
Implement allowlisting for administrative access.
Monitor NETCONF/API activity and abnormal control-plane behavior.
5. Validate system integrity
Check for unexpected version downgrades or reboots, which attackers may use to exploit the flaw and conceal activity.
Read the full article HERE