# Cisco SD-WAN auth bypass exploited globally

Published: 2026-02-26 · Severity: critical
Canonical: https://vorant.io/reports/de190417-1eb5-5fc6-8c85-92c36704e888/cisco-sd-wan-auth-bypass-exploited-globally

> CISA confirms active exploitation of CVE-2026-20127 and CVE-2022-20775 in Cisco Catalyst SD-WAN systems worldwide, enabling attackers to bypass authentication and gain admin access.

Multiple vulnerabilities in Cisco Catalyst SD-WAN products are under active exploitation by malicious cyber actors targeting organizations globally. CISA added CVE-2026-20127 (a previously undisclosed authentication bypass flaw) and CVE-2022-20775 to its Known Exploited Vulnerabilities Catalog on February 25, 2026, after observing attackers chain these vulnerabilities to compromise SD-WAN systems. Attackers exploit CVE-2026-20127 for initial access, then escalate privileges via CVE-2022-20775 to establish persistent access.

The most severe vulnerability (CVE-2026-20127) exists in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller and Manager, allowing unauthenticated remote attackers to bypass authentication and obtain administrative privileges. Successfully exploited, attackers can log in as a high-privileged internal user, access NETCONF, and manipulate network configuration for the entire SD-WAN fabric. Additional vulnerabilities in the advisory include API authentication bypass (CVE-2026-20129), privilege escalation flaws, arbitrary file overwrites, and information disclosure issues.

Affected systems span multiple versions of Cisco Catalyst SD-WAN Manager and SD-WAN products, with several versions reaching end-of-life status. Patches are available or releasing imminently for supported versions. Organizations running affected systems should apply updates immediately, implement network segmentation to isolate SD-WAN infrastructure, and conduct thorough reviews for indicators of compromise given the confirmed active exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2022-20775 (KEV), CVE-2026-20122 (KEV), CVE-2026-20126, CVE-2026-20127 (KEV), CVE-2026-20128 (KEV), CVE-2026-20129, CVE-2026-20133 (KEV)

## Detection guidance (public sample)

### External NETCONF Connection to Cisco SD-WAN Management Interface

ATT&CK: T1190

Detects inbound NETCONF (port 830) connections to Cisco SD-WAN Controller/Manager from outside expected management network ranges, consistent with post-auth-bypass configuration manipulation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: External NETCONF Connection to Cisco SD-WAN Management Interface
id: f4b48026-f859-5f3e-814d-79242f532c57
status: experimental
description: Detects network connections to the NETCONF service port (830) on Cisco
  SD-WAN Controller/Manager systems originating from source addresses outside of designated
  management network ranges. This behaviour is consistent with exploitation of CVE-2026-20127,
  where attackers bypass authentication and reach NETCONF to manipulate SD-WAN fabric
  configuration.
references:
- https://sec.cloudapps.cisco.com/security/center/publicationListing.x
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
  category: network_connection
detection:
  selection:
    DestinationPort: 830
  filter_mgmt_net:
    SourceIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_mgmt_net
falsepositives:
- Legitimate NETCONF management traffic from an internal jump host or NMS that is
  not covered by the listed management CIDR ranges
- Newly onboarded management subnets not yet added to the allow-list
level: high
```

### External Administrative Web Access to Cisco SD-WAN Manager Interface

ATT&CK: T1190

Detects connections to the Cisco SD-WAN Manager/Controller HTTPS administrative ports (443/8443) from source addresses outside internal management ranges, indicative of exploitation of the exposed authentication bypass vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: External Administrative Web Access to Cisco SD-WAN Manager Interface
id: 0501a1bc-ebf9-5c98-af03-ad0a60166c97
status: experimental
description: Detects inbound connections to Cisco Catalyst SD-WAN Manager/Controller
  administrative web ports (443/8443) originating from outside internal management
  network ranges. Successful exploitation of CVE-2026-20127 allows unauthenticated
  attackers to reach this interface and obtain administrative privileges, so any external
  access to it should be treated as suspicious per vendor and CISA guidance for isolating
  SD-WAN management infrastructure.
references:
- https://sec.cloudapps.cisco.com/security/center/publicationListing.x
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
  category: network_connection
detection:
  selection:
    DestinationPort:
    - 443
    - 8443
  filter_mgmt_net:
    SourceIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_mgmt_net
falsepositives:
- Legitimate remote administration from VPN-terminated addresses not represented in
  internal CIDR ranges
- Third-party monitoring or backup integrations reaching the management interface
  from unlisted internal subnets
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-catalyst-sd-wan-products-could-allow-for-authentication-bypass_2026-016

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/de190417-1eb5-5fc6-8c85-92c36704e888/cisco-sd-wan-auth-bypass-exploited-globally.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup