CVE-2026-20127: UAT-8616 Exploiting Cisco Catalyst SD-WAN Zero-Day

Summary

CVE-2026-20127 is a critical authentication bypass vulnerability (CVSS v3.1: 10.0) affecting Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage). This Cisco Catalyst SD-WAN zero-day vulnerability has been actively exploited since at least 2023 by the nation-state-linked threat actor UAT-8616, targeting global critical infrastructure environments.

The flaw stems from a fundamental failure in the SD-WAN peering authentication mechanism, allowing unauthenticated remote attackers to impersonate trusted SD-WAN components and gain high-privileged control-plane access. Because the vulnerability is inherent to the authentication logic itself, no workaround exists — immediate patching is the only complete remediation. The Cisco Catalyst SD-WAN zero-day impacts on-premises deployments, Cisco Hosted SD-WAN Cloud, FedRAMP environments, and end-of-maintenance versions.

Vulnerability Details

CVE-2026-20127 — Cisco Catalyst SD-WAN Authentication Bypass

CVE-2026-20127 carries a maximum CVSS v3.1 score of 10.0, classified as a zero-day vulnerability actively listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The Cisco Catalyst SD-WAN Controller and Manager authentication bypass originates from the trust validation process that establishes secure control-plane relationships between SD-WAN components. This process fails to properly verify identity and credentials, enabling an attacker to introduce a rogue device accepted as a legitimate SD-WAN peer.

An unauthenticated remote attacker exploits this Cisco SD-WAN vulnerability by sending specially crafted requests to an exposed controller or manager interface. Successful exploitation grants access as the internal “vmanage-admin” account — a high-privileged non-root user. From there, the attacker can access the NETCONF interface and manipulate configurations across the entire SD-WAN fabric, including routing policies, segmentation rules, and peer relationships. Compromise of the SD-WAN controller enables broad control-plane manipulation with high impact to confidentiality, integrity, and availability.

Adversaries exploiting CVE-2026-20127 have chained the attack with CVE-2022-20775 — a Cisco SD-WAN path traversal privilege escalation flaw — to achieve full root-level access. Attackers deliberately downgrade the controller software to exploit the path traversal vulnerability, then restore the original version to obscure evidence of compromise. Post-exploitation activity observed in UAT-8616 campaigns includes:

• Unauthorized SSH key deployment
• Creation and deletion of malicious accounts
• Log tampering and truncation
• Rogue control-plane peering events
• Persistent backdoor access

Affected Versions (CVE-2026-20127): Cisco Catalyst SD-WAN Controller and Manager versions before 20.9.8.2, 20.12.6.1, 20.12.5.3, 20.15.4.2, and 20.18.2.1 (CWE-287)

Affected Versions (CVE-2022-20775): Cisco SD-WAN Software versions before 20.6.3 to 20.6.4 (CWE-25, CWE-22)

Recommendations

1. Apply Cisco Security Updates Immediately

Upgrade all Cisco Catalyst SD-WAN Controller and SD-WAN Manager instances to the fixed software releases specified by Cisco: 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2, or 20.18.2.1, depending on your current release train. For releases earlier than 20.9 or end-of-life releases such as 20.11, 20.13, 20.14, and 20.16, migrate to a supported fixed release immediately. This is the only complete remediation for CVE-2026-20127, as no workarounds exist.

2. Conduct Forensic Investigation for Indicators of Compromise

Review the auth.log file at /var/log/auth.log for entries containing “Accepted publickey for vmanage-admin” from unknown or unauthorized IP addresses. Check for creation or deletion of unfamiliar user accounts, unexpected root sessions, and unauthorized SSH keys in /home/vmanage-admin/.ssh/authorized_keys and /home/root/.ssh/authorized_keys. Also look for abnormally small or missing log files, evidence of software downgrades and reboots, and unexplained peering events in SD-WAN logs.

3. Restrict Network Access to SD-WAN Control Components

Implement ACLs, security group rules, and firewall rules to restrict traffic to ports 22 and 830 on SD-WAN controllers. Allow only known controller IPs and authorized management hosts. Prevent access from unsecured networks — particularly the internet — to SD-WAN management and control plane interfaces. Deploy controllers behind filtering devices and consider a two-layer firewall architecture.

4. Enable External Log Storage and Enhanced Monitoring

Forward all SD-WAN system logs to external, centralized logging infrastructure (e.g., a SIEM solution) to prevent log tampering by a threat actor with root access. Monitor for unexpected traffic patterns, unauthorized peering events, software version changes, and unusual administrative activity. Retain logs for a sufficient duration to support post-incident investigation.

5. Harden SD-WAN Administrative Access

Disable HTTP access to the Cisco Catalyst SD-WAN Manager web UI and use SSL/TLS with certificates from a trusted certificate authority. Change all default administrator passwords to strong, unique alternatives and create role-based user accounts with minimum necessary privileges. Disable unnecessary network services including HTTP and FTP. Refer to the Cisco Catalyst SD-WAN Hardening Guide for comprehensive guidance.

MITRE ATT&CK TTPs

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
• https://blog.talosintelligence.com/uat-8616-sd-wan/
• https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems
• https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF