CVE-2026-20127 - Cisco Catalyst Zero-Day Vulnerability

THE THREAT

On February 25th, 2026, Cisco disclosed a critical zero-day vulnerability within the Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart) and Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) products, regardless of device configuration. The vulnerability, tracked as CVE-2026-20127 (CVSS: 10), can allow an unauthenticated attacker to bypass authentication and obtain administrative privileges on impacted systems. Successful exploitation can allow an attacker to log into the device as an internal, high-privileged, non-root user.

Patches have been released to address the vulnerability. Cisco has confirmed that they are aware of "limited exploitation" of CVE-2026-20127, underscoring the urgency that relevant patches are applied immediately.

What we’re doing about it

• eSentire Managed Vulnerability Service (MVS) has a plugin in place for CVE-2022-20775
  • A plugin for CVE-2026-20127 is marked as Coming Soon
• eSentire's Threat Response Unit (TRU) is evaluating detection opportunities
• eSentire's Threat Intelligence team is tracking this topic for additional details

What you should do about it

• After performing a business impact review, apply the relevant security patches provided by Cisco
• If an immediate update is not possible for on-prem deployments, organizations can evaluate the application of temporary mitigations steps from Cisco
  • Guardrails are in place for Cisco Hosted SD-WAN Cloud, Cisco Hosted SD-WAN Cloud - FedRAMP Environment and Cisco Hosted SD-WAN Cloud - Cisco Managed

Additional information

Along with the disclosure, Cisco Talos published a report providing additional information on the observed exploitation of CVE-2026-20127, which they attribute to the UAT-8616. Cisco states that after the discovery of exploitation of the zero-day vulnerability, they found "evidence that the malicious activity went back at least three years", to 2023. Cisco assesses with "high confidence" that UAT-8616 is a "highly sophisticated cyber threat actor", but no specific attribution is provided.

The Australian Signals Directorate's (ASD) Australian Cyber Security Centre (ACSC) published a joint report on this same activity, indicating that exploitation enabled the attacker to add a rogue peer to the Cisco SD-WAN management and control plane, allowing them to interact with devices in the restricted management plane. This access was used to downgrade the SD-WAN Controller to a version that was vulnerable to a privilege escalation vulnerability, tracked as CVE-2022-20775 (CVSS: 7.8), which was used to elevate privileges to root. Following exploitation of CVE-2022-20775, the threat actor upgraded the SD-WAN Controller back to its previous version, created local user accounts, and used the Network Configuration Protocol (NETCONF) and SSH for lateral movement.

On February 25th, the United States Cybersecurity and Infrastructure Agency (CISA) published an emergency directive for both CVE-2026-20127 and CVE-2022-20775, requiring that federal agencies apply mitigations by February 27th. CISA also added the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. At the time of writing, there is no publicly available Proof-of-Concept (PoC) exploit code for CVE-2026-20127, but this can rapidly change, so organizations utilizing the Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager products should prioritize patching as soon as possible.

Cisco provides mitigation steps for organizations using On-Premises SD-WAN Deployments, which provide guidelines for securing intra-controller connectivity through the use of Access Control Lists (ACLs), security group rules, and firewall rules. These items should restrict traffic to port 22 and 830, only allowing known IP addresses. Cisco indicates that these guardrails are in place for Cisco hosted SD-WAN Cloud, SD-WAN Cloud - FedRAMP Environment, and SD-WAN Cloud - Cisco Managed deployments. Cisco also recommends that organizations audit the auth.log files, located at /var/log/auth.log, for entries related to "Accepted publickey for vmanage-admin" from "unknown or unauthorized IP addresses". Customers can also open a case with the Cisco Technical Assistance Center (TAC) for assistance in determining if a device was impacted.

*These releases have reached End of Software Maintenance and should be upgraded to a supported release

References:
[1] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-20127
[3] https://blog.talosintelligence.com/uat-8616-sd-wan/
[4] https://www.cyber.gov.au/sites/default/files/2026-02/ACSC-led%20Cisco%20SD-WAN%20Hunt%20Guide.pdf
[5] https://nvd.nist.gov/vuln/detail/cve-2022-20775
[6] https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems
[7] https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-adds-two-known-exploited-vulnerabilities-catalog
[8] https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/cisco-sd-wan-overlay-network-bringup.html#c_Firewall_Ports_for_Viptela_Deployments_8690.xml