Cisco Catalyst SD-WAN Manager: Authentication bypass in peering authentication
Deadline for US federal agencies: 27 Feb 2026
Summary
A critical flaw in the peering authentication of Cisco Catalyst SD-WAN Controller, SD-WAN Manager and SD-WAN Validator allows an unauthenticated remote attacker to bypass authentication and gain administrative access. The attacker can log in as an internal, high-privileged non-root account and use NETCONF to change the configuration of the SD-WAN fabric. Systems reachable from the internet, or with management ports exposed, are at particular risk. Cisco reports limited exploitation in the wild, and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.
Affected
- Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager and Catalyst SD-WAN Validator, regardless of device configuration
- On-premises deployments and Cisco Hosted SD-WAN Cloud (Cisco Managed and FedRAMP environments)
- Exact affected releases: see the Fixed Software section of the Cisco advisory
Fixed in
- Upgrade to a fixed software release as listed in the Cisco advisory cisco-sa-sdwan-rpa-EHchtZk
- Fixed releases reported in secondary sources (verify against the Cisco advisory before changes): 20.9.8.2 (20.9 train); 20.12.5.3 (20.12.5); 20.12.6.1 (20.12.6); 20.15.4.2 (20.13 to 20.15); 20.18.2.1 (20.16 and 20.18)
- Releases 20.11 and earlier, 20.13, 20.14 and 20.16 are past end of software maintenance: migrate to a supported release
- Do not use the fixes for the separate CVE-2026-20182 as a substitute
Workaround
Unknown. Cisco states that no workarounds address this vulnerability. Temporary mitigations are listed in the Cisco advisory.
Exploitation
- Listed in CISA KEV on 2026-02-25
- Cisco PSIRT is aware of limited exploitation
- CISA SSVC assessment: exploitation active, automatable, total technical impact
- Reported chaining with CVE-2022-20775 to escalate to root
- Indicators: SSH logins for the internal vmanage-admin account from unknown IP addresses and unexpected peering events
Our recommendation
- Upgrade affected systems to a fixed release without delay; no workaround exists
- Restrict management access (SSH port 22 and NETCONF port 830) and control interfaces to trusted networks; do not expose them to the internet
- Check /var/log/auth.log for Accepted publickey entries for vmanage-admin from unknown IP addresses and compare them with the configured System IPs
- Validate all control connection peering events manually
- If compromise is suspected, collect the admin-tech file and open a case with Cisco TAC
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (9 repositories)
zerozenxlabs/CVE-2026-20127---Cisco-SD-WAN-Preauth-RCE · randeepajayasekara/CVE-2026-20127 · BugFor-Pings/CVE-2026-20127_EXP · yonathanpy/CVE-2026-20127-Cisco-SD-WAN-Preauth-RCE · abrahamsurf/sdwan-scanner-CVE-2026-20127 - Metasploit module auxiliary/admin/networking/cisco_sdwan_auth_bypass – Cisco Catalyst SD-WAN Controller Authentication Bypass
Research sources
- Cisco Security Advisory cisco-sa-sdwan-rpa-EHchtZk sec.cloudapps.cisco.com
- CISA Known Exploited Vulnerabilities Catalog entry CVE-2026-20127 www.cisa.gov
- Canadian Cyber Centre alert AL26-004 www.cyber.gc.ca
- Singapore CSA alert AL-2026-019 www.csa.gov.sg
- Rapid7 analysis of CVE-2026-20127 www.rapid7.com
- Censys advisory CVE-2026-20127 censys.com
- CIS advisory on Cisco Catalyst SD-WAN authentication bypass www.cisecurity.org
- The Hacker News: Cisco SD-WAN zero-day CVE-2026-20127 thehackernews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:52.
Original description (NVD)
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
Required action (CISA)
Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.