Cyber security alert: active exploitation of Cisco Catalyst SD-WAN vulnerabilities

Security agencies including the UK National Cyber Security Centre (NCSC) have issued coordinated warnings that threat actors are actively exploiting a critical vulnerability in Cisco Catalyst SD-WAN environments.

The primary vulnerability, CVE-2026-20127, is an authentication bypass flaw that allows attackers to gain administrative access without valid credentials. Successful exploitation enables malicious actors to insert a rogue peer into the SD-WAN control plane, creating a foothold that can lead to root-level persistence within the network infrastructure.

Multiple international cyber authorities, including the NSA, CISA, NCSC-UK and other Five Eyes partners, have published joint guidance after investigations revealed exploitation activity dating back to at least 2023.

Technical overview

CVE-2026-20127 (CVSS 10.0 – Critical) affects the authentication mechanism used by Cisco Catalyst SD-WAN Controller (vSmart) and SD-WAN Manager (vManage).

The flaw allows an unauthenticated remote attacker to bypass authentication by sending crafted requests, enabling login as a high-privileged internal user. From there, attackers can access management interfaces such as NETCONF, which allows manipulation of SD-WAN configuration and control-plane behaviour.

Cisco has confirmed that the vulnerability affects both on-premise deployments and hosted SD-WAN environments.

Once access is established, attackers can insert a malicious “rogue peer” device into the SD-WAN fabric, effectively allowing them to operate as a trusted network component.

Security researchers and government investigators have observed attackers using this access to:

• Modify SD-WAN control-plane configuration

• Escalate privileges to root access

• Create persistent administrative accounts

• Insert SSH keys for long-term access

• Remove logs and disable monitoring to evade detection

Investigations attribute the activity cluster to a sophisticated threat group tracked by Cisco Talos as UAT-8616.

Additional vulnerabilities also under active exploitation

Cisco has also confirmed active exploitation of two additional vulnerabilities affecting Cisco Catalyst SD-WAN Manager:

CVE-2026-20122
Allows attackers with read-only API credentials to overwrite arbitrary files, potentially gaining higher-privileged user access.

CVE-2026-20128
An information disclosure vulnerability exposing credential files that may allow attackers to obtain privileged access to additional systems.

These vulnerabilities increase the urgency for organisations running Cisco SD-WAN infrastructure to patch their environments immediately.

Why this matters

SD-WAN controllers and managers operate within the network control plane, meaning compromise can allow attackers to manipulate routing, segmentation and policy across multiple sites.

The joint threat hunt guidance emphasises that attackers are not deploying traditional malware in these environments. Instead, they focus on persistence, stealth and long-term access to network infrastructure, making detection more challenging.

Organisations using Cisco SD-WAN to connect branch offices or manage hybrid networks may therefore face significant operational and security risks if these systems are compromised.

Organisations most at risk

According to the NCSC, environments are particularly vulnerable where SD-WAN management interfaces are exposed to the internet.

Security authorities stress that SD-WAN management interfaces should never be publicly accessible.

Enterprises using SD-WAN for:

• Multi-site connectivity

• Cloud integration

• Critical infrastructure networks

• Large branch networks

should treat these systems as high-value infrastructure assets and prioritise remediation.

Recommended mitigations

Organisations using Cisco Catalyst SD-WAN should take the following actions immediately:

• Apply Cisco security updates – Install fixed releases addressing CVE-2026-20127 and associated vulnerabilities.
• Remove internet exposure – Ensure SD-WAN management interfaces are not accessible from the public internet.
• Restrict administrative access – Limit access to management systems through trusted networks or jump hosts and apply strict firewall controls.
• Review authentication and access controls – Audit privileged accounts and remove unauthorised SSH keys or unexpected administrative users.
• Enable centralised logging – Ensure logs are forwarded off-device to prevent attackers from erasing evidence.
• Monitor for suspicious activity – Investigate unexpected SSH access, new peers in the SD-WAN control plane, or unexplained configuration changes.

Our Guidance

Organisations relying on SD-WAN technology should treat management platforms as critical network infrastructure and ensure they are included in vulnerability management and monitoring programmes.

Given confirmed active exploitation and the high severity of these vulnerabilities, patching and configuration review should be prioritised immediately.