Vulnerability record · CVE-2026-20127 · published 25 February 2026
CVE-2026-20127: Cisco Catalyst SD-WAN peering authentication bypass
Cisco · Catalyst Sd Wan Manager
The peering authentication mechanism in Cisco Catalyst SD-WAN Controller, Manager and Validator does not work properly, letting an unauthenticated remote attacker bypass authentication with crafted requests. A successful exploit grants login as an internal high-privileged non-root account, which matters because it exposes NETCONF and the ability to manipulate SD-WAN fabric configuration.
Description
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 10.0, unauthenticated remote authentication bypass, KEV-listed with a two-day federal remediation deadline and EPSS above the 99th percentile.
What it is
The peering authentication mechanism in Cisco Catalyst SD-WAN Controller, Manager and Validator does not work properly, letting an unauthenticated remote attacker bypass authentication with crafted requests. A successful exploit grants login as an internal high-privileged non-root account, which matters because it exposes NETCONF and the ability to manipulate SD-WAN fabric configuration.
Impact
An attacker gains administrative, non-root access to the SD-WAN Controller and, through NETCONF, can read and alter network configuration across the SD-WAN fabric. That is a full compromise of the management plane for the affected deployment.
Attack surface
Reachable over the network via crafted requests to the peering authentication service; the CVSS vector shows no privileges and no user interaction required. No authentication is needed, so any host that can reach the affected SD-WAN component can attempt it.
Exploitation
CVE-2026-20127 is listed in CISA KEV with a 2026-02-25 addition and a 2026-02-27 remediation due date, and EPSS gives a 30-day probability of 0.88243 (99.761st percentile). No ransomware campaign use is documented in the record.
What to do
- Apply the Cisco security advisory fix for Catalyst SD-WAN Controller, Manager and Validator as the first action.
- Follow CISA Emergency Directive 26-03 and the CISA Hunt & Hardening Guidance for Cisco SD-WAN devices.
- Restrict network access to SD-WAN peering and management interfaces to trusted sources only.
- Rotate credentials and review accounts on affected SD-WAN components for unauthorized high-privileged non-root logins.
- If mitigations are not available, apply BOD 22-01 guidance for cloud services or discontinue use of the product.
Detection
- Hunt for unexpected logins to SD-WAN Controller as internal high-privileged non-root accounts.
- Monitor NETCONF sessions and configuration changes on SD-WAN Controller, Manager and Validator for unauthorized activity.
- Review network logs for crafted requests to peering authentication endpoints from untrusted sources.
- Alert on authentication events that succeed without a corresponding valid peer identity or credential exchange.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-20127 to the Known Exploited Vulnerabilities catalog on 25 February 2026 as "Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability". Required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal deadline 27 February 2026.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127 | US Government Resource |
Track CVE-2026-20127 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-20127), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
