Critical Cisco SD-WAN Vulnerability Carries Maximum Severity Score of 10 (CVE-2026-20127)

A critical authentication bypass vulnerability affecting Cisco Catalyst SD-WAN infrastructure has been assigned the maximum CVSS severity score of 10.0. Tracked as CVE-2026-20127, the flaw could allow unauthenticated remote attackers to obtain administrative privileges, potentially giving them control over network configurations.

Cisco disclosed the vulnerability on 25 February 2026, warning that a weakness in the peering authentication mechanism could allow attackers to bypass security controls on affected systems. Security researchers and government cybersecurity agencies have reported evidence of exploitation in the wild, making the vulnerability a significant concern for organisations using Cisco’s software-defined networking technology. Source: Cisco advisory.

Which Cisco products are affected?

CVE-2026-20127 affects Cisco Catalyst SD-WAN Controller, formerly known as vSmart, and Cisco Catalyst SD-WAN Manager, previously called vManage. The vulnerability is associated with the peering authentication process used by these systems to establish trusted relationships within an SD-WAN deployment.

Cisco Catalyst SD-WAN Validator, formerly vBond, is also named in the vendor’s advisory.

The vulnerability is classified as CWE-287, or improper authentication. Its CVSS 3.1 score of 10.0 reflects the potential for a remote attacker to exploit the weakness without existing credentials, requiring no user interaction and potentially compromising the confidentiality, integrity and availability of affected systems.

The risk extends across on-premises installations and supported Cisco-hosted SD-WAN cloud deployments.

How the vulnerability works

The flaw exists because the peering authentication mechanism does not operate correctly. An attacker can send specially crafted requests to an affected system in an attempt to bypass the normal authentication process.

Successful exploitation could allow an attacker to access a Cisco Catalyst SD-WAN Controller using an internal, highly privileged non-root account. From there, the attacker could access NETCONF, a network configuration protocol used to manage network devices, and manipulate the configuration of the SD-WAN fabric.

This access could provide a route to changing network settings, interfering with communications and establishing a foothold within an organisation’s network infrastructure.

The consequences could extend beyond the initially compromised controller, depending on the attacker’s access and the design of the affected network.

Active exploitation and potential impact

The vulnerability is particularly concerning because exploitation has been observed in real-world attacks. Cisco’s Talos intelligence team and government cybersecurity agencies have linked activity to a threat actor tracked as UAT-8616. Security reporting indicates that attackers have used compromised SD-WAN infrastructure to establish unauthorised peer connections and maintain persistent access. Tenable®+1

The Canadian Centre for Cyber Security has also reported incidents in which malicious peers were added to affected organisations’ SD-WAN configurations, enabling further administrative access and long-term persistence. Canadian Centre for Cyber Security

These findings highlight the risks associated with compromising centralised network management infrastructure. An attacker who gains control of an SD-WAN component may be able to affect connectivity and security across multiple sites rather than a single device.

How organisations can protect themselves

Cisco has released software updates to address CVE-2026-20127 and recommends upgrading affected systems to a fixed release. The company states that no workaround fully resolves the vulnerability. sec.cloudapps.cisco.com

Administrators should consult Cisco’s official advisory to identify the correct fixed release for their deployment. The published guidance includes the following upgrade paths:

Affected software release	Fixed release
Earlier than 20.9	Migrate to a fixed release
20.9	20.9.8.2
20.11	20.12.6.1
20.12	20.12.5.3 or 20.12.6.1, as applicable
20.13, 20.14 or 20.15	20.15.4.2
20.16 or 20.18	20.18.2.1

Organisations should verify the precise upgrade requirements against the official Cisco security advisory, particularly where older releases have reached end of maintenance. sec.cloudapps.cisco.com

In addition to patching, security teams should:

• Restrict access to SD-WAN control components using firewalls and access control lists.
• Limit access to management ports, including TCP ports 22 and 830, to authorised systems.
• Review authentication logs for unexpected successful logins and unfamiliar source IP addresses.
• Investigate unexpected peering events, unknown devices and unauthorised configuration changes.
• Preserve system logs and virtual snapshots to support forensic investigations.
• Forward logs to a remote logging server and follow Cisco’s SD-WAN hardening guidance.

Cisco specifically recommends checking /var/log/auth.log for unexpected successful public-key authentication involving the vmanage-admin account and validating the source addresses against authorised system IPs. sec.cloudapps.cisco.com

Where compromise is suspected, organisations should preserve relevant evidence and conduct a threat-hunting investigation rather than assuming that installing a patch alone will remove an attacker’s existing access. Joint guidance from cybersecurity agencies also recommends collecting evidence, checking for indicators of compromise and then fully patching affected infrastructure. NCSC NZ

Conclusion

CVE-2026-20127 demonstrates how weaknesses in authentication mechanisms can expose critical network infrastructure to remote attackers. With a CVSS score of 10.0 and confirmed exploitation, the vulnerability represents a serious risk to organisations relying on Cisco Catalyst SD-WAN.

Administrators should prioritise checking their software versions, applying the appropriate security updates and investigating any signs of unauthorised access. Given the possibility of persistent access following a successful attack, organisations should also review their SD-WAN configurations and security logs to establish whether their infrastructure has already been compromised.

Further information

• Cisco security advisory – CVE-2026-20127
• Canadian Centre for Cyber Security alert
• Tenable vulnerability analysis