Cisco SD-WAN auth bypass exploited globally
CISA confirms active exploitation of CVE-2026-20127 and CVE-2022-20775 in Cisco Catalyst SD-WAN systems worldwide, enabling attackers to bypass authentication and gain admin access.
Multiple vulnerabilities in Cisco Catalyst SD-WAN products are under active exploitation by malicious cyber actors targeting organizations globally. CISA added CVE-2026-20127 (a previously undisclosed authentication bypass flaw) and CVE-2022-20775 to its Known Exploited Vulnerabilities Catalog on February 25, 2026, after observing attackers chain these vulnerabilities to compromise SD-WAN systems. Attackers exploit CVE-2026-20127 for initial access, then escalate privileges via CVE-2022-20775 to establish persistent access.
The most severe vulnerability (CVE-2026-20127) exists in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller and Manager, allowing unauthenticated remote attackers to bypass authentication and obtain administrative privileges. Successfully exploited, attackers can log in as a high-privileged internal user, access NETCONF, and manipulate network configuration for the entire SD-WAN fabric. Additional vulnerabilities in the advisory include API authentication bypass (CVE-2026-20129), privilege escalation flaws, arbitrary file overwrites, and information disclosure issues.
Affected systems span multiple versions of Cisco Catalyst SD-WAN Manager and SD-WAN products, with several versions reaching end-of-life status. Patches are available or releasing imminently for supported versions. Organizations running affected systems should apply updates immediately, implement network segmentation to isolate SD-WAN infrastructure, and conduct thorough reviews for indicators of compromise given the confirmed active exploitation.
Mentioned in this report
Detection guidance
External NETCONF Connection to Cisco SD-WAN Management Interface
Detects inbound NETCONF (port 830) connections to Cisco SD-WAN Controller/Manager from outside expected management network ranges, consistent with post-auth-bypass configuration manipulation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: External NETCONF Connection to Cisco SD-WAN Management Interface
id: f4b48026-f859-5f3e-814d-79242f532c57
status: experimental
description: Detects network connections to the NETCONF service port (830) on Cisco
SD-WAN Controller/Manager systems originating from source addresses outside of designated
management network ranges. This behaviour is consistent with exploitation of CVE-2026-20127,
where attackers bypass authentication and reach NETCONF to manipulate SD-WAN fabric
configuration.
references:
- https://sec.cloudapps.cisco.com/security/center/publicationListing.x
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
category: network_connection
detection:
selection:
DestinationPort: 830
filter_mgmt_net:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_mgmt_net
falsepositives:
- Legitimate NETCONF management traffic from an internal jump host or NMS that is
not covered by the listed management CIDR ranges
- Newly onboarded management subnets not yet added to the allow-list
level: high
External Administrative Web Access to Cisco SD-WAN Manager Interface
Detects connections to the Cisco SD-WAN Manager/Controller HTTPS administrative ports (443/8443) from source addresses outside internal management ranges, indicative of exploitation of the exposed authentication bypass vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: External Administrative Web Access to Cisco SD-WAN Manager Interface
id: 0501a1bc-ebf9-5c98-af03-ad0a60166c97
status: experimental
description: Detects inbound connections to Cisco Catalyst SD-WAN Manager/Controller
administrative web ports (443/8443) originating from outside internal management
network ranges. Successful exploitation of CVE-2026-20127 allows unauthenticated
attackers to reach this interface and obtain administrative privileges, so any external
access to it should be treated as suspicious per vendor and CISA guidance for isolating
SD-WAN management infrastructure.
references:
- https://sec.cloudapps.cisco.com/security/center/publicationListing.x
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
category: network_connection
detection:
selection:
DestinationPort:
- 443
- 8443
filter_mgmt_net:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_mgmt_net
falsepositives:
- Legitimate remote administration from VPN-terminated addresses not represented in
internal CIDR ranges
- Third-party monitoring or backup integrations reaching the management interface
from unlisted internal subnets
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-catalyst-sd-wan-products-could-allow-for-authentication-bypass_2026-016
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free