Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited Since 2023 for Admin Access
Summary: Cisco disclosed CVE-2026-20127, a CVSS 10.0 authentication bypass in Catalyst SD-WAN Controller and Manager that lets an unauthenticated remote attacker gain administrative privileges via a crafted request, with exploitation tracked since 2023 under the actor name UAT-8616. Cisco and the ASD-ACSC say the actor created a rogue peer joined to the SD-WAN management or control plane, then used the built-in update mechanism to downgrade software and escalate to root via CVE-2022-20775 before restoring the original version.
What's compelling: CISA added both CVEs to its KEV catalog and issued Emergency Directive 26-03, giving federal agencies 24 hours to apply fixes and requiring an inventory of in-scope SD-WAN systems by February 26, 2026 - a timeline that signals how exposed internet-facing SD-WAN controllers are treated as a route into critical infrastructure.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2022-20775CVE-2026-20127
- Related
- Active exploitation of Cisco Catalyst SD-WAN by UAT-8616 Cyber Risks ·