CVE-2022-20775Active Exploitation(cisco / 1100-4g_integrated_services_router)

CRITICALCVSS 7.8 · HIGHCISA KEV

Exploitation observed; activity peaked at 17 mentions and remains active

Immediate actions

Patch cisco 1100-4g_integrated_services_router systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

cisco CVEs Back to dashboard

8.3/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-02-27. Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Exploit / PoC references

Vendor / third-party advisories

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20775

Weakness type (CWE)

CWE-25CWE-22

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

1100-4g_integrated_services_router
1100-4p_integrated_services_router
1100-6g_integrated_services_router
1100-8p_integrated_services_router

Threat summary

Active exploitation appears in 45 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
47 mentions across 14 observed days

What's happening

Active exploitation reported across 45 signals
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 27 signals
Technical details provided in 40 signals
General: 2 classified signals
Peaked 12d ago at 17 mentions (2026-02-26); latest day: 1
47 total mentions across 14 days

Affected systems

Vendors

cisco

Products

1100-4g_integrated_services_router1100-4p_integrated_services_router1100-6g_integrated_services_router1100-8p_integrated_services_router1100_integrated_services_router1101-4p_integrated_services_router1101_integrated_services_router1109-2p_integrated_services_router1109-4p_integrated_services_router1109_integrated_services_router

2 versions affected across 84 products

Deep dive

Activity timeline47 mentions / 14d

Signal classification2 categories

Active Exploitation

4595.7%

General

24.3%

Referenced assets61 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-25	14	Active Exploitation14
2026-02-26	17	Active Exploitation17
2026-02-27	4	Active Exploitation3General1
2026-03-01	1	Active Exploitation1
2026-03-03	1	Active Exploitation1
2026-03-04	1	Active Exploitation1
2026-03-05	2	Active Exploitation2
2026-03-06	1	General1
2026-03-09	1	Active Exploitation1
2026-03-12	1	Active Exploitation1
2026-03-18	1	Active Exploitation1
2026-04-03	1	Active Exploitation1
2026-05-15	1	Active Exploitation1
2026-06-12	1	Active Exploitation1

Full discourse20 posts

FBI Cyber Division@FBICyberDiv225d
Active Exploitation
🚨 Malicious cyber actors are targeting and compromising Cisco SD-WAN systems deployed by organizations worldwide. These actors have exploited a previously undisclosed authentication bypass vulnerability, CVE-2026-20127, for initial access before escalating privileges using CVE-2022-20775 and establishing long-term persistence in Cisco SD-WAN systems. The FBI urges network defenders to fully patch Cisco SD-WAN systems and hunt for evidence of compromise. Find info and resources from @CISACyber 👉 https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-and-partners-release-guidance-ongoing-global-exploitation-cisco-sd-wan-systems
Post summary
CISA alerts that attackers are actively exploiting an authentication bypass in Cisco SD‑WAN (CVE‑2026‑20127) and urges immediate patching and hunting for compromise.
31151113636928.6K
2.9K followersView on X
CISA Cyber@CISACyber225d
Active Exploitation
🚨 Cyber threat actors are exploiting multiple Cisco vulnerabilities, including CVE-2026-20127 and CVE-2022-20775, to ultimately establish long-term persistence in SD-WAN systems across multinational organizations. Review our Alert & act immediately. 👉 https://go.dhs.gov/iHw https://t.co/ktTANz3875
Post summary
The alert reports that threat actors are actively exploiting Cisco CVE-2026-20127 and CVE-2022-20775 to establish long‑term persistence in SD‑WAN systems, urging immediate action.
56241624718.4K
292.1K followersView on X
CISA Cyber@CISACyber225d
Active Exploitation
🛡️ We added Cisco Catalyst SD-WAN path traversal vulnerability CVE-2022-20775 & Controller and Manager authentication bypass vulnerability CVE-2026-20127 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. https://t.co/ZicRI3q7Ph
Post summary
The tweet announces that two Cisco vulnerabilities (CVE-2022-20775 and CVE-2026-20127) have been added to the DHS KEV catalog, indicating they are actively exploited, and urges applying mitigations.
22005588.3K
292.1K followersView on X
Defused@DefusedCyber225d
Active Exploitation
🚨Two Cisco Catalyst SD-WAN Controller vulns added to CISA KEV today CVE-2026-20127 (auth bypass) and CVE-2022-20775 (path traversal) are actively being exploited in the wild by nation-state actor UAT-8616 since 2023. No public PoC exists for either - we've added a Cisco SD-WAN honeypot stream to catch exploitation attempts🍯 http://console.defusedcyber.com/signup
Post summary
Two Cisco SD‑WAN Controller CVEs (auth bypass and path traversal) are being actively exploited by a nation‑state actor; no public PoC or patch is mentioned, but a honeypot is deployed to detect attacks.
315140148.4K
6.1K followersView on X
Dark Web Informer@DarkWebInformer225d
Active Exploitation
‼️ CISA has added two Cisco vulnerabilities to the KEV Catalog https://darkwebinformer.com/cisa-kev-catalog/ CVE-2022-20775: Cisco SD-WAN Path Traversal Vulnerability CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
Post summary
CISA has added two Cisco vulnerabilities to the KEV catalog, indicating they are actively exploited in the wild.
0701743.3K
168.3K followersView on X
piyokango@piyokango224d
Active Exploitation
米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（2/25追加） 🛡️No.1529 CVE-2022-20775 Cisco Catalyst SD-WAN Path Traversal Vulnerability ============= CVSSスコア： 7.8 (Base) / Cisco Systems, Inc. CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 種別：パストラバーサル (/../filedir) (CWE-25 / Cisco Systems, Inc.) 深刻度：重要 ---------------------- 悪用時影響：認証済みの攻撃者により、ローカル上よりアプリケーション CLI 内のコマンドに対する不適切なアクセス制御を介してルートユーザーとして任意のコマンドを実行される恐れがあります。 https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html 🛡️No.1530 CVE-2026-20127 Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability ============= CVSSスコア： 10.0 (Base) / Cisco Systems, Inc. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 種別：不適切な認証 (CWE-287 / Cisco Systems, Inc.) 深刻度：緊急🔥 ---------------------- 悪用時影響：事前認証されていない攻撃者により、特別に細工されたリクエストの送信を介して、高権限の非ルートユーザーでログインされる恐れがあります。この脆弱性を悪用された場合、NETCONF にアクセスし、SD-WAN ファブリックのネットワーク構成を操作される可能性があります。 https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-adds-two-known-exploited-vulnerabilities-catalog #vulnerability
Post summary
CISA has added two Cisco SD‑WAN vulnerabilities to its catalog, confirming they are actively exploited and providing mitigation guidance.
0201414.1K
42.6K followersView on X
kokumօtօ@__kokumoto224d
Active Exploitation
Cisco Catalyst SD-WANの重大(Critical)なゼロデイ脆弱性2件(CVE-2022-20775, CVE-2026-20127)が、米国サイバーセキュリティ・社会基盤安全保障庁(CISA)の既知の悪用された脆弱性カタログに追加。対処期限は2/27で、国家安全保障リスク相当。ランサムウェアによる悪用は不知。 https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-adds-two-known-exploited-vulnerabilities-catalog
Post summary
Two critical zero‑day vulnerabilities in Cisco Catalyst SD‑WAN have been added to CISA’s known‑exploited vulnerabilities catalog, indicating active exploitation and a fix deadline of February 27, with no ransomware exploitation confirmed.
130831.4K
7.3K followersView on X
kokumօtօ@__kokumoto224d
Active Exploitation
【一体どこの中国なんだ…】Cisco Catalyst SD-WANのゼロデイ脆弱性2件(CVE-2022-20775, CVE-2026-20127)について、ファイブ・アイズ各国当局から警告。なお、CVE-2026-20127はCVSSスコア10。 https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-and-partners-release-guidance-ongoing-global-exploitation-cisco-sd-wan-systems
Post summary
The post warns of two zero‑day vulnerabilities in Cisco Catalyst SD‑WAN, with CVE‑2026‑20127 rated CVSS 10, and cites a CISA alert indicating ongoing global exploitation.
040622.1K
7.3K followersView on X
JustaBreach@justabreach224d
Active Exploitation
🚨🔴 Zero-day critique: Cisco SD-WAN activement exploité (CVE-2026-20127) - Cisco a publié hier (25 février) un correctif pour une vulnérabilité d'authentification bypass (score CVSS 10/10) dans ses solutions Catalyst SD-WAN Controller (ex-vSmart) et Catalyst SD-WAN Manager (ex-vManage). - Elle est exploitée depuis 2023 pour obtenir des privilèges admin sans authentification, ajouter des peers malveillants et persister longtemps dans les réseaux. - Les agences de cybersécurité des 5 Eyes (États-Unis CISA, Australie ACSC, Canada, Nouvelle-Zélande, Royaume-Uni) ont publié une alerte conjointe + un guide de threat hunting très détaillé. - CISA a émis une Emergency Directive (ED 26-03) : les agences fédérales américaines doivent inventorier leurs SD-WAN Cisco aujourd'hui avant minuit (26/02), collecter logs/snapshots, et patcher impérativement demain avant 17h (27/02). Ça concerne aussi CVE-2022-20775 (path traversal) en combo. - Risque imminent pour les réseaux fédéraux US, mais l'exploitation est globale
Post summary
The post reports that CVE‑2026‑20127 is actively exploited in the wild, with a vendor patch available and a CISA Emergency Directive urging immediate remediation.
01060857
2.7K followersView on X
Not a Gladiator Gorkus Maximus@Kek_Gladiator_223d
Active Exploitation
Another day, another "critical" Cisco zero-day chain turning edge devices into persistent backdoors for APTs. CVE-2026-20127 (CVSS 10.0 auth bypass) + clever downgrade to exploit CVE-2022-20775 → root on SD-WAN controllers since at least 2023. UAT-8616 (likely nation-state) has been chilling in strategic orgs & critical infra for 3+ years. Talos finally drops the UAT-8616 cluster name, CISA screams "patch now" with a 24-48h federal deadline, and joint hunt guide from Five Eyes. But let's be real: if your perimeter gear exposes mgmt to the internet in 2026 and still runs vulnerable peering auth... who's really at fault here? Pro tip: Harden your SD-WAN yesterday, not after the espionage tour is over. Cisco, maybe ship less 10/10 bugs? Just a thought. 😏
Post summary
The post describes that CVE‑2026‑20127 and CVE‑2022‑20775 have been actively exploited on Cisco SD‑WAN controllers for years, prompting a federal patch deadline, but no PoC or exploit code details are shared.
00120222
129 followersView on X
iototsecnews@iototsecnews210d
Active Exploitation
Cisco Catalyst SD-WAN ゼロデイ CVE-2026-20127：PoC エクスプロイト公開と実環境での悪用 https://iototsecnews.jp/2026/03/06/poc-exploit-released-cisco-sd-wan-0-day-vulnerability-exploited-in-the-wild/ 今回の脆弱性 CVE-2026-20127 の原因は、Cisco Catalyst SD-WAN Controller の認証メカニズムの不備にあります。本来であれば厳格に確認されるべきログイン・プロセスが、特定の HTTP リクエストにより回避されてしまうため、管理者権限の不正な取得を攻撃者に許してしまいます。さらに、侵入した攻撃者は、意図的に古いバージョンへダウングレードさせ、過去の脆弱性である CVE-2022-20775 を再悪用して root 権限を奪取するという、非常に巧妙な手法を組み合わせて実行します。認証プロセスのわずかな隙が、システム全体の制御を失う深刻な事態に繋がっているため、まずは認証の仕組みとログの動きを丁寧に確認することが大切です。 #CatalystSDWAN #Cisco #CVE202620127 #CyberAttack #Exploit #PoC #Vulnerability #ZeroDay
Post summary
A PoC and exploit for Cisco Catalyst SD‑WAN CVE‑2026‑20127 have been released, and attackers are already exploiting it in production environments to gain admin and root rights.
01001194
484 followersView on X
TechNadu@TechNadu224d
Active Exploitation
Five Eyes agencies warn: @Cisco SD-WAN is under active exploitation by UAT-8616. Targets: • CVE-2026-20127 • CVE-2022-20775 Root access, rogue peering, persistence in critical networks. Immediate patching & threat hunting urged. #CyberSecurity #Cisco #SDWAN #CISA https://t.co/0U99bSAdhc
Post summary
Five Eyes agencies warn that Cisco SD‑WAN is being actively exploited via UAT‑8616 targeting CVE‑2026‑20127 and CVE‑2022‑20775, with root access and rogue peering, urging immediate patching and threat hunting.
10100173
10.0K followersView on X
Cydome Security 🛡️⚓@cydome188d
Active Exploitation
▶️ Exploitation of Cisco SD-WAN Zero-Days (CVE-2026-20127 & CVE-2022-20775, CVSS 9.8) Active exploitation has been detected targeting an authentication bypass and privilege escalation chain in Cisco Catalyst SD-WAN Controller software.
Post summary
The text confirms that active exploitation of two Cisco SD-WAN zero-days (CVE-2026-20127 & CVE-2022-20775) has been detected, highlighting authentication bypass and privilege escalation vulnerabilities worth CVSS 9.8.
1000047
145 followersView on X
Horizon3.ai@Horizon3ai216d
General
Attackers may also chain this with CVE-2022-20775 by downgrading software to escalate privileges further.
Post summary
The excerpt notes that attackers might chain CVE-2022-20775 by downgrading software to escape privileges, but it provides no technical, exploit, or patch details.
1000078
2.6K followersView on X
Hassan Kamalkhani@NeacaSpace218d
Active Exploitation
CISA ED-26-03 + KEV catalog addition: CVE-2026-20127 & CVE-2022-20775 actively exploited → root takeover risk in SD-WAN fabrics. Actions: inventory devices by Feb 26 EOD, apply Cisco patches, collect AWS logs, hunt for compromise. Federal agencies required.
Post summary
The bulletin states that CVE-2026-20127 and CVE-2022-20775 are actively exploited, creating root takeover risk in SD‑WAN fabrics, and urges applying Cisco patches and monitoring for compromise.
0001083
4 followersView on X
Cyber News Live@cybernewslive220d
Active Exploitation
A critical zero-day vulnerability, CVE-2026-20127, in Cisco Catalyst SD-WAN Controllers has been actively exploited for at least three years. Attackers can bypass authentication to gain high-level access. The US government has mandated federal agencies patch this flaw and an older one, CVE-2022-20775, by Friday. If you manage Cisco SD-WAN devices, update to a fixed version immediately and restrict internet access to these systems. 🚨 #CyberNewsLive https://darkreading.com/vulnerabilities-threats/cisco-sd-wan-zero-day-exploitation-3-years
Post summary
CVE‑2026‑20127 in Cisco SD‑WAN Controllers is actively exploited for years; federal agencies and users are urged to patch immediately and restrict internet access.
01000149
1.5K followersView on X
Andre Gironda@AndreGironda223d
General
BlueFalconInk -- CISA ED 26-03 Compliance Tracker -- Rapid-response compliance tool for Federal Agencies and enterprises to meet the mandates of CISA Emergency Directive 26-03 regarding Cisco SD-WAN vulnerabilities CVE-2026-20127 , CVE-2022-20775 -- https://github.com/bluefalconink/cisa-ed-26-03-tracker
Post summary
The post announces a compliance tracker tool to help meet CISA Emergency Directive 26‑03 for Cisco SD‑WAN vulnerabilities CVE‑2026‑20127 and CVE‑2022‑20775, but provides no detailed vulnerability or exploitation information.
00010278
3.6K followersView on X
ThreatSynop@ThreatSynop224d
Active Exploitation
🚨 Cisco SD-WAN zero-day CVE-2026-20127 exploited since 2023 to gain admin access and plant rogue peers Cisco disclosed CVE-2026-20127 (CVSS 10.0) in Catalyst SD-WAN Controller/Manager is being exploited in the wild to bypass peering authentication and obtain high-privilege admin access, enabling NETCONF-based SD-WAN fabric manipulation (including adding attacker-controlled “rogue peers”) and follow-on actions like log wiping and persistence. CISA added CVE-2026-20127 and CVE-2022-20775 to KEV and issued emergency guidance, so exposed SD-WAN management planes should be patched and hunted immediately. 🎯 Target: Global/Organizations using Cisco Catalyst SD-WAN #️⃣ Category: #Vulnerability #BlueTeam #CyberIntel 🔗 URL: https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html
Post summary
CVE-2026-20127 is actively exploited in the wild to gain admin access and manipulate Cisco SD‑WAN fabric, with CISA issuing emergency guidance and urging immediate patching.
0001094
221 followersView on X
ThreatSynop@ThreatSynop224d
Active Exploitation
🚨 Critical Cisco SD-WAN zero-day (CVE-2026-20127) exploited since 2023 to bypass auth and reach root Cisco disclosed CVE-2026-20127 (CVSS 10.0) being exploited in the wild since at least 2023 to bypass peering authentication on Catalyst SD-WAN Controller/Manager, letting attackers manipulate NETCONF and SD-WAN fabric configs (e.g., add rogue peers) and, via chaining CVE-2022-20775, escalate to root for long-term persistence. 🎯 Target: Global/Organizations using Cisco Catalyst SD-WAN #️⃣ Category: #Vulnerability #BlueTeam #CyberIntel 🔗 URL: https://cybersecuritynews.com/cisco-sd-wan-0-day-vulnerability/
Post summary
Cisco’s CVE-2026-20127 is actively exploited in the wild since 2023, allowing attackers to bypass authentication, manipulate SD‑WAN configurations, and chain with CVE-2022-20775 to gain root access.
00010148
221 followersView on X
キタきつね@foxbook224d
Active Exploitation
CISAが2つの既知の脆弱性をカタログに追加 CISA Adds Two Known Exploited Vulnerabilities to Catalog #CISA (Feb 25) CVE-2022-20775 Cisco Catalyst SD-WAN パストラバーサル脆弱性 CVE-2026-20127 Cisco Catalyst SD-WAN コントローラおよびマネージャの認証バイパスの脆弱性 https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-adds-two-known-exploited-vulnerabilities-catalog
Post summary
CISA has added two Cisco SD‑WAN vulnerabilities—CVE‑2022‑20775 (path traversal) and CVE‑2026‑20127 (authentication bypass)—to its catalog of known exploited weaknesses, indicating active exploitation in the wild.
00010329
4.7K followersView on X

CPE platform detail89 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

89 of 89 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	cisco	1100-4g_integrated_services_router	-	-	-
HW	cisco	1100-4p_integrated_services_router	-	-	-
HW	cisco	1100-6g_integrated_services_router	-	-	-
HW	cisco	1100-8p_integrated_services_router	-	-	-
HW	cisco	1100_integrated_services_router	-	-	-
HW	cisco	1101-4p_integrated_services_router	-	-	-
HW	cisco	1101_integrated_services_router	-	-	-
HW	cisco	1109-2p_integrated_services_router	-	-	-
HW	cisco	1109-4p_integrated_services_router	-	-	-
HW	cisco	1109_integrated_services_router	-	-	-
HW	cisco	1111x-8p_integrated_services_router	-	-	-
HW	cisco	1111x_integrated_services_router	-	-	-
HW	cisco	111x_integrated_services_router	-	-	-
HW	cisco	1120_integrated_services_router	-	-	-
HW	cisco	1131_integrated_services_router	-	-	-
HW	cisco	1160_integrated_services_router	-	-	-
HW	cisco	4000_integrated_services_router	-	-	-
HW	cisco	4221_integrated_services_router	-	-	-
HW	cisco	4321\/k9-rf_integrated_services_router	-	-	-
HW	cisco	4321\/k9-ws_integrated_services_router	-	-	-
HW	cisco	4321\/k9_integrated_services_router	-	-	-
HW	cisco	4321_integrated_services_router	-	-	-
HW	cisco	4331\/k9-rf_integrated_services_router	-	-	-
HW	cisco	4331\/k9-ws_integrated_services_router	-	-	-
HW	cisco	4331\/k9_integrated_services_router	-	-	-
HW	cisco	4331_integrated_services_router	-	-	-
HW	cisco	4351\/k9-rf_integrated_services_router	-	-	-
HW	cisco	4351\/k9-ws_integrated_services_router	-	-	-
HW	cisco	4351\/k9_integrated_services_router	-	-	-
HW	cisco	4351_integrated_services_router	-	-	-
HW	cisco	4431_integrated_services_router	-	-	-
HW	cisco	4451-x_integrated_services_router	-	-	-
HW	cisco	4451_integrated_services_router	-	-	-
HW	cisco	4461_integrated_services_router	-	-	-
HW	cisco	8101-32fh	-	-	-
HW	cisco	8101-32h	-	-	-
HW	cisco	8102-64h	-	-	-
HW	cisco	8201	-	-	-
HW	cisco	8201-32fh	-	-	-
HW	cisco	8202	-	-	-
HW	cisco	8804	-	-	-
HW	cisco	8808	-	-	-
HW	cisco	8812	-	-	-
HW	cisco	8818	-	-	-
HW	cisco	8831	-	-	-
HW	cisco	asr_1000	-	-	-
HW	cisco	asr_1000-x	-	-	-
HW	cisco	asr_1001	-	-	-
HW	cisco	asr_1001-hx	-	-	-
HW	cisco	asr_1001-hx_r	-	-	-
HW	cisco	asr_1001-x	-	-	-
HW	cisco	asr_1001-x_r	-	-	-
HW	cisco	asr_1002	-	-	-
HW	cisco	asr_1002-hx	-	-	-
HW	cisco	asr_1002-hx_r	-	-	-
HW	cisco	asr_1002-x	-	-	-
HW	cisco	asr_1002-x_r	-	-	-
HW	cisco	asr_1004	-	-	-
HW	cisco	asr_1006	-	-	-
HW	cisco	asr_1006-x	-	-	-
HW	cisco	asr_1009-x	-	-	-
HW	cisco	asr_1013	-	-	-
HW	cisco	asr_1023	-	-	-
App	cisco	catalyst_8000v_edge	-	-	-
HW	cisco	catalyst_8200	-	-	-
HW	cisco	catalyst_8300	-	-	-
HW	cisco	catalyst_8300-1n1s-4t2x	-	-	-
HW	cisco	catalyst_8300-1n1s-6t	-	-	-
HW	cisco	catalyst_8300-2n2s-4t2x	-	-	-
HW	cisco	catalyst_8300-2n2s-6t	-	-	-
HW	cisco	catalyst_8500	-	-	-
HW	cisco	catalyst_8500-4qc	-	-	-
HW	cisco	catalyst_8500l	-	-	-
HW	cisco	catalyst_8510csr	-	-	-
HW	cisco	catalyst_8510msr	-	-	-
HW	cisco	catalyst_8540csr	-	-	-
HW	cisco	catalyst_8540msr	-	-	-
App	cisco	catalyst_cg418-e	-	-	-
App	cisco	catalyst_cg522-e	-	-	-
App	cisco	catalyst_sd-wan_manager	-	-	-
App	cisco	catalyst_sd-wan_manager	20.8	-	-
App	cisco	sd-wan	-	-	-
App	cisco	sd-wan	20.8	-	-
App	cisco	sd-wan_vbond_orchestrator	-	-	-
App	cisco	sd-wan_vbond_orchestrator	20.8	-	-
App	cisco	sd-wan_vedge_cloud	-	-	-
App	cisco	sd-wan_vedge_cloud	20.8	-	-
App	cisco	sd-wan_vsmart_controller	-	-	-
App	cisco	sd-wan_vsmart_controller	20.8	-	-

Explore more

Back to dashboard cisco CVEs 1100-4g_integrated_services_router vulnerabilities

What researchers are saying

CVE-2022-20775

FBI Cyber Division[verified]@FBICyberDivActive Exploitation

CISA alerts that attackers are actively exploiting an authentication bypass in Cisco SD‑WAN (CVE‑2026‑20127) and urges immediate patching and hunting for compromise.

piyokango[verified]@piyokangoActive Exploitation

CISA has added two Cisco SD‑WAN vulnerabilities to its catalog, confirming they are actively exploited and providing mitigation guidance.

kokumօtօ[verified]@__kokumotoActive Exploitation

Two critical zero‑day vulnerabilities in Cisco Catalyst SD‑WAN have been added to CISA’s known‑exploited vulnerabilities catalog, indicating active exploitation and a fix deadline of February 27, with no ransomware exploitation confirmed.

kokumօtօ[verified]@__kokumotoActive Exploitation

The post warns of two zero‑day vulnerabilities in Cisco Catalyst SD‑WAN, with CVE‑2026‑20127 rated CVSS 10, and cites a CISA alert indicating ongoing global exploitation.

JustaBreach[verified]@justabreachActive Exploitation

The post reports that CVE‑2026‑20127 is actively exploited in the wild, with a vendor patch available and a CISA Emergency Directive urging immediate remediation.

Not a Gladiator Gorkus Maximus[verified]@Kek_Gladiator_Active Exploitation

The post describes that CVE‑2026‑20127 and CVE‑2022‑20775 have been actively exploited on Cisco SD‑WAN controllers for years, prompting a federal patch deadline, but no PoC or exploit code details are shared.

TechNadu[verified]@TechNaduActive Exploitation

Five Eyes agencies warn that Cisco SD‑WAN is being actively exploited via UAT‑8616 targeting CVE‑2026‑20127 and CVE‑2022‑20775, with root access and rogue peering, urging immediate patching and threat hunting.

Horizon3.ai[verified]@Horizon3aiGeneral

The excerpt notes that attackers might chain CVE-2022-20775 by downgrading software to escape privileges, but it provides no technical, exploit, or patch details.