CVE-2026-20127Active Exploitation(cisco / catalyst_sd-wan_manager)

CRITICALCVSS 10.0 · CRITICALCISA KEV

Exploitation observed; activity peaked at 116 mentions and remains active

Immediate actions

Patch cisco catalyst_sd-wan_manager systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. 

cisco CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-02-27. Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Vendor / third-party advisories

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127

Weakness type (CWE)

CWE-287

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

catalyst_sd-wan_manager
sd-wan_vbond_orchestrator
sd-wan_vsmart_controller

Threat summary

Active exploitation appears in 299 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
416 mentions across 56 observed days

What's happening

Active exploitation reported across 299 signals
Exploit tool or code specified in 22 signals
PoC mentioned or linked in 32 signals
Patch or workaround mentioned in 138 signals
Technical details provided in 245 signals
General: 47 classified signals
Disclosure: 35 classified signals
Peaked 54d ago at 116 mentions (2026-02-26); latest day: 1
416 total mentions across 56 days

Affected systems

Vendors

cisco

Products

catalyst_sd-wan_managersd-wan_vbond_orchestratorsd-wan_vsmart_controller

1 version affected across 3 products

Deep dive

Activity timeline416 mentions / 56d

Signal classification7 categories

Active Exploitation

28067.3%

General

4711.3%

Disclosure

358.4%

Patch

348.2%

PoC

102.4%

Exploit

92.2%

Referenced assets278 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-25	49	Active Exploitation39Disclosure4General4Patch2
2026-02-26	116	Active Exploitation95Disclosure8General9Patch4
2026-02-27	38	Active Exploitation26Disclosure3General5Patch4
2026-02-28	15	Active Exploitation5Disclosure4General4PoC2
2026-03-01	9	Active Exploitation5Disclosure1General2Patch1
2026-03-02	25	Active Exploitation14Disclosure6Exploit1General2Patch2
2026-03-03	10	Active Exploitation5Disclosure1General2Patch2
2026-03-04	12	Active Exploitation6Disclosure1Exploit1General1Patch1PoC2
2026-03-05	16	Active Exploitation12General2Patch2
2026-03-06	17	Active Exploitation7Exploit1General3Patch3PoC3
2026-03-07	6	Active Exploitation5General1
2026-03-08	6	Active Exploitation5Patch1
2026-03-09	9	Active Exploitation6Exploit1Patch1PoC1
2026-03-10	7	Active Exploitation4Disclosure1Exploit1General1
2026-03-11	5	Active Exploitation1Exploit1General2PoC1
2026-03-12	8	Active Exploitation4Exploit1General2PoC1
2026-03-13	7	Active Exploitation2Disclosure1General2Patch2
2026-03-14	5	Active Exploitation2Patch3
2026-03-16	3	Active Exploitation3
2026-03-17	1	Patch1
2026-03-18	2	Active Exploitation1Patch1
2026-03-21	1	Disclosure1
2026-03-23	2	Active Exploitation1Patch1
2026-03-27	1	Active Exploitation1
2026-04-01	1	Active Exploitation1
2026-04-03	2	Active Exploitation1General1
2026-04-10	1	Exploit1
2026-04-11	1	Active Exploitation1
2026-04-13	1	Patch1
2026-04-15	2	Active Exploitation2
2026-04-17	1	False Positive1
2026-04-20	1	General1
2026-04-21	2	Active Exploitation2
2026-04-22	1	Disclosure1
2026-04-23	1	General1
2026-05-01	1	Active Exploitation1
2026-05-05	2	Active Exploitation1Disclosure1
2026-05-12	1	Active Exploitation1
2026-05-14	1	Active Exploitation1
2026-05-15	5	Active Exploitation4Patch1
2026-05-16	1	Active Exploitation1
2026-05-18	3	Active Exploitation1Disclosure2
2026-05-24	1	Active Exploitation1
2026-06-01	1	General1
2026-06-05	2	Active Exploitation2
2026-06-06	1	Active Exploitation1
2026-06-07	1	Active Exploitation1
2026-06-09	3	Active Exploitation3
2026-06-14	2	Active Exploitation2
2026-06-17	1	Patch1
2026-06-25	1	Active Exploitation1
2026-06-26	1	Active Exploitation1
2026-06-27	1	Exploit1
2026-07-02	1	Active Exploitation1
2026-07-18	1	General1
2026-09-15	1	Active Exploitation1

Full discourse20 posts

FBI Cyber Division@FBICyberDiv225d
Active Exploitation
🚨 Malicious cyber actors are targeting and compromising Cisco SD-WAN systems deployed by organizations worldwide. These actors have exploited a previously undisclosed authentication bypass vulnerability, CVE-2026-20127, for initial access before escalating privileges using CVE-2022-20775 and establishing long-term persistence in Cisco SD-WAN systems. The FBI urges network defenders to fully patch Cisco SD-WAN systems and hunt for evidence of compromise. Find info and resources from @CISACyber 👉 https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-and-partners-release-guidance-ongoing-global-exploitation-cisco-sd-wan-systems
Post summary
Malicious actors are actively exploiting an authentication bypass in Cisco SD‑WAN (CVE‑2026‑20127) and escalating privileges with CVE‑2022‑20775; the FBI urges immediate patching and investigation.
31151113636928.6K
2.9K followersView on X
Stephen Fewer@stephenfewer147d
Active Exploitation
Today @rapid7 and Cisco are disclosing CVE-2026-20182, a critical (CVSS 10.0) auth bypass affecting Cisco Catalyst SD-WAN Controller, found by @_CryptoCat and I when we were researching CVE-2026-20127 last Feb. An unauth attacker can become the vmanage-admin and issue arbitrary NETCONF commands. Cisco has also disclosed that the new CVE is already EITW as of this month. Read our blog here with full technical details: https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/
Post summary
Rapid7 and Cisco disclose CVE-2026-20182, a CVSS 10.0 authentication bypass in Cisco Catalyst SD‑WAN Controller, and confirm it is already exploited in the wild, providing a link to a blog with detailed technical information.
790628611771.6K
9.8K followersView on X
BleepingComputer@BleepinComputer225d
Active Exploitation
🚨 Cisco and cyber agencies warn a critical 10.0 Cisco SD-WAN flaw (CVE-2026-20127) was exploited in zero-day attacks since at least 2023. Attackers used it to compromise controllers and add malicious rogue peers to targeted networks. ➡️Learn more: https://www.bleepingcomputer.com/news/security/critical-cisco-sd-wan-bug-exploited-in-zero-day-attacks-since-2023/
Post summary
Cisco SD‑WAN flaw CVE‑2026‑20127 has been actively exploited in zero‑day attacks since 2023, allowing attackers to compromise controllers and insert rogue peers into targeted networks.
97252327726.9K
248.5K followersView on X
CISA Cyber@CISACyber225d
Active Exploitation
🚨 Cyber threat actors are exploiting multiple Cisco vulnerabilities, including CVE-2026-20127 and CVE-2022-20775, to ultimately establish long-term persistence in SD-WAN systems across multinational organizations. Review our Alert & act immediately. 👉 https://go.dhs.gov/iHw https://t.co/ktTANz3875
Post summary
Threat actors are actively exploiting Cisco CVE-2026-20127 and CVE-2022-20775 to gain long‑term persistence in SD‑WAN systems, prompting immediate action.
56241624718.4K
292.1K followersView on X
The Hacker News@TheHackersNews224d
Active Exploitation
🚨 Cisco is warning of active exploitation of a CVSS 10.0 flaw in Catalyst SD-WAN controllers. CVE-2026-20127 lets unauthenticated attackers bypass auth and gain admin access. Exploitation tied to UAT-8616 dates back to 2023, including rogue peers in the control plane and root escalation. 🔗 Read → https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html
Post summary
Cisco warns of active exploitation of CVE-2026-20127, a CVSS 10.0 flaw that lets unauthenticated attackers bypass authentication and gain admin/root access on Catalyst SD‑WAN controllers.
83911261939.0K
1.0M followersView on X
CryptoCat@_CryptoCat211d
Active Exploitation
🚨 CVE-2026-20127: Cisco SD-WAN authentication bypass. An unauthenticated attacker can inject SSH keys without crypto verification via a flawed state machine. Active exploitation by UAT-8616 since 2023 💀 Check out the full @rapid7 analysis 👇 https://attackerkb.com/topics/bP3FMvHe7z/cve-2026-20127/rapid7-analysis
Post summary
The tweet reports that CVE-2026-20127 is actively exploited since 2023, allowing unauthenticated attackers to inject SSH keys via a flawed state machine.
4283963819.6K
8.5K followersView on X
Unit 42@Unit42_Intel224d
Active Exploitation
Unit 42 is tracking CVE-2026-20127, an actively exploited zero-day vuln in Cisco Catalyst SD-WAN Controller. We recommend updating to the latest versions, hunting for signs of compromise and reviewing the Talos Threat Advisory here: https://bit.ly/46uYApr https://t.co/L2AhJtbgYG
Post summary
Unit 42 reports that CVE-2026-20127 is an actively exploited zero‑day vulnerability in Cisco Catalyst SD‑WAN Controller and urges users to update to the latest versions and monitor for compromise.
227169207.8K
66.8K followersView on X
CryptoCat@_CryptoCat211d
PoC
@rapid7 PoC from @stephenfewer 🔥 https://github.com/sfewer-r7/CVE-2026-20127
Post summary
Rapid7 shares a Proof of Concept for CVE‑2026‑20127, linking to a GitHub repository that likely contains the exploit code.
051684371.3K
8.5K followersView on X
watchTowr@watchtowrcyber225d
Active Exploitation
🚨 watchTowr is rapidly reacting to CVE-2026-20127, a critical auth bypass in Cisco’s Catalyst SD-WAN Controller with active in-the-wild exploitation reported. Patch urgently. Active watchTowr Platform clients have been made aware of their exposure - reach out via the watchTowr website for support.
Post summary
CVE-2026-20127 is an auth bypass in Cisco Catalyst SD-WAN Controller that is actively exploited in the wild; urgent patching is advised for affected watchTowr Platform clients.
220267267.8K
11.0K followersView on X
Defused@DefusedCyber218d
Active Exploitation
🚨 Cisco SD-WAN CVE-2026-20127 is under active exploitation by multiple attackers Exploit activity is decently heavy with attackers trying to implement multiple persistence mechanisms Attacker in screenshot implements a gsocket/gs-netcat based backdoor connected to a Telegram bot, using kernel thread name spoofing ([kswapd0], [ksmd]) to hide processes. Patch immediately. If on an affected version, assume compromise and hunt. Track exploitation 👉 https://console.defusedcyber.com/intel
Post summary
The post reports that CVE‑2026‑20127 is actively being exploited by attackers using a gsocket/gs‑netcat backdoor, and urges immediate patching. No PoC or detailed technical data are offered beyond the tool mention and exploit technique.
4222573117.8K
6.1K followersView on X
Simo@SimoKohonen217d
Active Exploitation
Webshells be flowing into Cisco SD-WAN honeypots now.. Exploitation of CVE-2026-20127 is looking pretty heavy, new actors popping up by the hour https://t.co/rO3gxeNr7h
Post summary
The tweet reports that CVE-2026-20127 is being actively exploited in the wild, with new attackers emerging frequently.
2191652015.7K
2.9K followersView on X
CISA Cyber@CISACyber225d
Active Exploitation
🛡️ We added Cisco Catalyst SD-WAN path traversal vulnerability CVE-2022-20775 & Controller and Manager authentication bypass vulnerability CVE-2026-20127 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. https://t.co/ZicRI3q7Ph
Post summary
The tweet announces that two Cisco vulnerabilities have been added to the DHS KEV catalog, indicating they are actively exploited, and urges applying mitigations.
22005588.3K
292.1K followersView on X
Metasploit Project@metasploit181d
Exploit
This week's release features a 2x faster msfvenom bootup time and new modules, including exploits for the Cisco Catalyst SD-WAN Controller Authentication Bypass (CVE-2026-20127) and osTicket Arbitrary File Read (CVE-2026-22200). https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-04-10-2026/
Post summary
Rapid7 announced new Metasploit modules that include functional exploit code for CVE-2026-20127 and CVE-2026-22200, marking them as available for use within the exploit framework.
012045164.8K
253.4K followersView on X
Defused@DefusedCyber225d
Active Exploitation
🚨Two Cisco Catalyst SD-WAN Controller vulns added to CISA KEV today CVE-2026-20127 (auth bypass) and CVE-2022-20775 (path traversal) are actively being exploited in the wild by nation-state actor UAT-8616 since 2023. No public PoC exists for either - we've added a Cisco SD-WAN honeypot stream to catch exploitation attempts🍯 http://console.defusedcyber.com/signup
Post summary
Two Cisco SD‑WAN Controller vulnerabilities (CVE‑2026‑20127 and CVE‑2022‑20775) are being actively exploited by a nation‑state actor; no public PoC or patch is available, but a honeypot is deployed to detect attacks.
315140148.4K
6.1K followersView on X
Ryan Dewhurst@ethicalhack3r218d
Active Exploitation
Overnight we observed the first exploitation attempts against Cisco Catalyst SD-WAN in our honeypots. Activity started around 03:00 UTC, leveraging the now-public PoC. CVE-2026-20127 If you're running SD-WAN and haven't patched yet, now would be a good time. @watchtowrcyber
Post summary
Multiple honeypots recorded the first real-world exploit attempts against Cisco Catalyst SD-WAN using CVE-2026-20127, leveraging a now-public PoC. Immediate patching is recommended.
015041127.6K
21.0K followersView on X
Dark Web Informer@DarkWebInformer213d
Exploit
‼️ CVE-2026-20127: Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited Since 2023 for Admin Access. PoC: https://github.com/zerozenxlabs/CVE-2026-20127---Cisco-SD-WAN-Preauth-RCE "This repository contains a working proof-of-concept exploit for CVE-2026-20127, a critical pre-authentication vulnerability in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Catalyst SD-WAN Manager (formerly vManage) that has been actively exploited in the wild since 2023."
Post summary
A publicly posted PoC exploit for CVE-2026-20127 demonstrates a critical pre‑authentication vulnerability in Cisco SD‑WAN controllers that has been actively exploited in the wild since 2023.
19036196.0K
171.6K followersView on X
Defused@DefusedCyber220d
General
⚠️Cisco SD-WAN (CVE-2026-20127) enumeration slowly on the increase We have observed fingeprinting attempts against vulnerable Cisco SD-WAN instances - involving either utilizing Nuclei templates for older CVE's (such as CVE-2020–26073) or probing various SD-WAN REST API authentication endpoints. No observed POC candidates as of yet Some IPs involved from the past 24 hours: 111.194.48.235 China Unicom Beijing Province 🇨🇳 158.174.210.97 Bahnhof AB 🇸🇪 95.215.0.144 Petersburg Internet Network ltd. 🇷🇺
Post summary
The post reports increased enumeration attempts against Cisco SD-WAN instances for CVE-2026-20127, with no PoC or exploit code observed, and no patch or technical details provided.
113133105.2K
6.1K followersView on X
Hunter@HunterMapping222d
Disclosure
🚨Alert🚨 CVE-2026-20127(Zero-Day, CVSS 10.0): Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability 📊 3.6K+ Services are found on the http://hunter.how yearly. 🔗Hunter Link:https://hunter.how/list?searchValue=product.name%3D%22Cisco%20Catalyst%20SD-WAN%22 👇Query HUNTER : http://product.name="Cisco Catalyst SD-WAN" 📰Refer:https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk #hunterhow #infosec #infosecurity #OSINT #Vulnerability
Post summary
The post announces a newly identified zero‑day authentication bypass vulnerability (CVE‑2026‑20127) in Cisco Catalyst SD‑WAN Controller with a CVSS score of 10.0, providing links to a security advisory and an external news article but no exploit or mitigation details.
38023132.3K
25.4K followersView on X
ANSSI@ANSSI_FR224d
Active Exploitation
⚠️ Vulnérabilité Cisco Catalyst SD-WAN. 📢 Le @CERT_FR a publié un bulletin d'alerte concernant la vulnérabilité activement exploitée CVE-2026-20127, affectant Cisco Catalyst SD-WAN. ➡️ + d'infos sur le site du CERT-FR : https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-002/ https://t.co/QxjAz9zl3x
Post summary
CERT‑FR has issued an alert that CVE‑2026‑20127 is actively exploited against Cisco Catalyst SD‑WAN, but no PoC, exploit code, patch, or technical details are provided.
01402225.0K
83.4K followersView on X
ZoomEye@zoomeye_team220d
Disclosure
🚨 CVE-2026-20127: Vulnerability Alert Critical Remote Code Execution via SD-WAN Orchestrator API Deserialization! An attacker sends a maliciously crafted serialized Java object in an authenticated API request to the Cisco vManage orchestrator, triggering unsafe deserialization that executes arbitrary code with root privileges on the underlying Linux system. Full Vulnerability Details & Analysis at DarkEye: 🔗 https://darkeye.org/vuln/cve/CVE-2026-20127 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-20127" Search Dork: app="Cisco Catalyst SD-WAN" Exposure: 2k+ instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaXNjbyBDYXRhbHlzdCBTRC1XQU4i&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260302 #Cisco #RCE #Deserialization #SDWAN #ZeroDay #DarkEye
Post summary
The tweet announces CVE-2026-20127 as a critical RCE via unsafe Java deserialization in Cisco SD‑WAN vManage, providing links for analysis and target identification but no PoC, exploit tool, or evidence of active exploitation.
0801732.0K
11.9K followersView on X

CPE platform detail6 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

6 of 6 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	cisco	catalyst_sd-wan_manager	-	-	-
App	cisco	catalyst_sd-wan_manager	20.12.6	-	-
App	cisco	sd-wan_vbond_orchestrator	-	-	-
App	cisco	sd-wan_vbond_orchestrator	20.12.6	-	-
App	cisco	sd-wan_vsmart_controller	-	-	-
App	cisco	sd-wan_vsmart_controller	20.12.6	-	-

Explore more

Back to dashboard cisco CVEs catalyst_sd-wan_manager vulnerabilities

What researchers are saying

CVE-2026-20127

FBI Cyber Division[verified]@FBICyberDivActive Exploitation

Malicious actors are actively exploiting an authentication bypass in Cisco SD‑WAN (CVE‑2026‑20127) and escalating privileges with CVE‑2022‑20775; the FBI urges immediate patching and investigation.

BleepingComputer[verified]@BleepinComputerActive Exploitation

Cisco SD‑WAN flaw CVE‑2026‑20127 has been actively exploited in zero‑day attacks since 2023, allowing attackers to compromise controllers and insert rogue peers into targeted networks.

watchTowr[verified]@watchtowrcyberActive Exploitation

CVE-2026-20127 is an auth bypass in Cisco Catalyst SD-WAN Controller that is actively exploited in the wild; urgent patching is advised for affected watchTowr Platform clients.

Simo[verified]@SimoKohonenActive Exploitation

The tweet reports that CVE-2026-20127 is being actively exploited in the wild, with new attackers emerging frequently.

Metasploit Project[verified]@metasploitExploit

Rapid7 announced new Metasploit modules that include functional exploit code for CVE-2026-20127 and CVE-2026-22200, marking them as available for use within the exploit framework.

Hunter[verified]@HunterMappingDisclosure

The post announces a newly identified zero‑day authentication bypass vulnerability (CVE‑2026‑20127) in Cisco Catalyst SD‑WAN Controller with a CVSS score of 10.0, providing links to a security advisory and an external news article but no exploit or mitigation details.

ZoomEye[verified]@zoomeye_teamDisclosure

The tweet announces CVE-2026-20127 as a critical RCE via unsafe Java deserialization in Cisco SD‑WAN vManage, providing links for analysis and target identification but no PoC, exploit tool, or evidence of active exploitation.

Stephen Fewer@stephenfewerActive Exploitation

Rapid7 and Cisco disclose CVE-2026-20182, a CVSS 10.0 authentication bypass in Cisco Catalyst SD‑WAN Controller, and confirm it is already exploited in the wild, providing a link to a blog with detailed technical information.