CVE-2026-20127

What it actually does

The flaw is a network-reachable authentication bypass in the Cisco Catalyst SD-WAN control-plane peering authentication mechanism affecting Cisco Catalyst SD-WAN Controller/vSmart and Cisco Catalyst SD-WAN Manager/vManage, with related SD-WAN control-plane components implicated by the advisory text. An unauthenticated remote attacker can send crafted peering requests that cause the system to treat the attacker as an internal high-privileged, non-root administrative user. With that access, the attacker can reach NETCONF and modify SD-WAN fabric configuration, potentially changing routing, policies, device templates, tunnel behavior, or other control-plane settings. The CVSS 10.0 rating reflects unauthenticated remote exploitation with full confidentiality, integrity, and availability impact and scope change.

Why it matters to the business

Successful exploitation can give an external attacker administrative control over the SD-WAN control plane, allowing them to disrupt branch connectivity, alter traffic paths, weaken segmentation, intercept or redirect network flows, and cause broad operational outages across sites dependent on the fabric. Because this issue is listed in CISA KEV, has active in-the-wild exploitation, and has a very high EPSS score, exposed systems should be treated as urgent remediation priorities; CISA’s remediation due date is 2026-02-27. Even without ransomware attribution, compromise of SD-WAN management and control systems can create enterprise-wide network risk and may enable follow-on intrusion into connected environments.

How an attack unfolds

An attacker first identifies an exposed Cisco Catalyst SD-WAN Manager/vManage or Controller/vSmart control-plane service. The attacker sends crafted peering authentication requests to the affected service, exploiting the broken peering authentication logic. If successful, the system grants access as an internal high-privileged non-root administrative account without requiring valid credentials. The attacker then uses that privilege to access NETCONF and issue configuration operations against the SD-WAN fabric. From there, the attacker can alter network configuration, push malicious or disruptive policy changes, manipulate routing and tunnels, degrade availability, or create changes that facilitate persistence and later movement through the network.

How to fix it

Upgrade affected Cisco Catalyst SD-WAN components to fixed software versions from Cisco as soon as they are available in the applicable Cisco security advisory; no exact fixed versions were provided in the input, so administrators should validate directly against Cisco’s official advisory and software checker. Prioritize all exposed Cisco Catalyst SD-WAN Manager/vManage and Controller/vSmart deployments, and include SD-WAN Validator/vBond where applicable. Until upgraded, restrict access to SD-WAN management, peering, and NETCONF interfaces to trusted management networks and known SD-WAN peers only; block direct internet exposure; enforce strict ACLs/firewall policy; monitor and limit TCP/830 NETCONF access; and review control-plane reachability between SD-WAN components. Rotate administrative credentials and review SD-WAN configuration state after patching if exploitation is suspected, because an attacker may have made persistent configuration changes before remediation.

How to confirm the fix worked

Confirm each Cisco Catalyst SD-WAN Manager/vManage, Controller/vSmart, and related control-plane appliance is running a Cisco-fixed release identified by the official advisory. Verify that management and control-plane interfaces are not exposed to untrusted networks and that NETCONF access is restricted to expected administrative sources. Review device inventory and software versions centrally, then independently confirm from the appliance CLI or management UI. Validate that recent SD-WAN configuration, templates, policies, routes, tunnel settings, certificates, peer definitions, and administrator accounts match expected baselines. Where possible, run an authenticated vulnerability scan or Cisco-recommended verification check after upgrade; unauthenticated internet scanning alone is not sufficient to prove non-exposure unless reachability is also blocked.

Typical attack path

1. Identify internet- or network-reachable Cisco Catalyst SD-WAN Manager/vManage, Controller/vSmart, or related SD-WAN control-plane services.
2. Send crafted peering authentication requests to the affected service.
3. Bypass authentication and obtain access as an internal high-privileged non-root administrative user.
4. Access NETCONF using the obtained privilege context.
5. Enumerate SD-WAN fabric configuration, device inventory, policies, and templates.
6. Modify configuration, routing, policies, tunnels, or device templates to achieve disruption, traffic redirection, interception, or persistence.
7. Cover tracks by blending changes into normal configuration activity or using legitimate management/control-plane channels.

How to detect it

Investigate SD-WAN Manager/vManage, Controller/vSmart, Validator/vBond, AAA, syslog, audit, NETCONF, and network-flow logs for signs of unauthenticated or unusual control-plane access. Focus on successful administrative sessions or internal high-privilege activity that lacks a normal login trail, unexpected NETCONF sessions, configuration changes from unusual source IPs, new or modified device templates, altered policies, unexpected routing/tunnel changes, peer relationship changes, certificate changes, or administrative activity outside approved change windows. Correlate TCP/830 activity with configuration commits and management UI/API activity. Review firewall and load-balancer logs for crafted or anomalous peering traffic from unknown sources to SD-WAN control-plane services. Because the issue is actively exploited, absence of a known exploit string is not proof of safety; prioritize behavioral evidence such as unexplained NETCONF edit operations, sudden SD-WAN policy changes, and administrative actions by internal service-like accounts. If logs are limited, compare current configuration against backups from before suspected exposure and look for unauthorized drift.

• tcp/830
• NETCONF
• netconf
• edit-config
• commit
• candidate
• running
• get-config
• copy-config
• delete-config
• lock
• unlock
• vmanage
• vsmart
• vbond
• peer authentication
• peering authentication
• configuration change
• template push
• policy change

What your security team should do

• Treat this as an emergency control-plane compromise risk because it is CVSS 10.0, CISA KEV-listed, actively exploited in the wild, and has a high EPSS score.
• Immediately identify all Cisco Catalyst SD-WAN Manager/vManage, Controller/vSmart, and related SD-WAN control-plane systems, including externally reachable and partner-reachable instances.
• Patch or upgrade to Cisco-fixed releases according to the official Cisco advisory; if patching cannot be completed immediately, isolate management, peering, and NETCONF access to trusted networks and known peers only.
• Block or tightly restrict inbound NETCONF access, especially TCP/830, and restrict SD-WAN management/control-plane access from the internet.
• Review SD-WAN audit logs, NETCONF activity, peering events, and configuration-change history for unauthorized access or unexplained changes since at least the publication date and preferably earlier based on log retention.
• Compare current SD-WAN configuration, policies, templates, routing, tunnels, peer relationships, and certificates against a known-good baseline.
• Rotate administrative credentials and review local/internal high-privilege accounts if suspicious activity is found.
• Prepare an outage-aware rollback plan before remediation because control-plane upgrades and configuration cleanup may affect branch connectivity.
• If compromise is suspected, preserve logs and appliance forensic artifacts before rebuilding or restoring from trusted configuration backups.