CVE entry · CVE-2026-20127
CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
- Actively exploited: added to CISA’s KEV catalog on February 25, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: February 27, 2026.
- CERT-FR alert CERTFR-2026-ALE-002 of February 25, 2026.
Description from CISA’s KEV catalog.
CERT-FR alerts and notices
-
CERTFR-2026-ALE-002[MàJ] Vulnérabilité dans Cisco Catalyst SD-WAN (25 février 2026)
What to do
- Check whether your estate includes Cisco Catalyst SD-WAN Controller and Manager, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (sec.cloudapps.cisco.com)
- NVD entry (NIST)
- CISA KEV catalog
Other Cisco vulnerabilities
-
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
-
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
-
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
-
Cisco Secure Email Gateway SQL Injection Vulnerability
-
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
-
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability