CVE-2026-20127
Authentication Bypass in Cisco Catalyst SD-WAN Controller and Manager. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 25 February 2026.
- Product
- Cisco Catalyst SD-WAN Controller and Manager
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- No known use in ransomware campaigns
- Vendor advisories
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
More from Cisco this year.
- CVE-2026-76418 Unchecked Return Value to NULL Pointer Dereference, added
- CVE-2026-76519 Relative Path Traversal, added
- CVE-2026-76504 Hex Encoding, added
- CVE-2026-76460 Incorrect Use of Privileged APIs, added
- CVE-2026-76461 SQL Injection, added
- CVE-2026-20079 Firewall Management Center Authentication Bypass Using an Alternate Path or Channel, added
- CVE-2026-20349 Heap Inspection, added
- CVE-2026-20316 Secure Firewall Management Center Use of Hard-coded Password, added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.