Cisco Catalyst SD-WAN authentication bypass enables admin access
CISA reports active exploitation of Cisco Catalyst SD-WAN authentication bypass vulnerabilities enabling attackers to gain admin access and establish persistence.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 7 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2022-20775, CVE-2026-20122, CVE-2026-20127, CVE-2026-20128, and CVE-2026-20133 as exploited in the wild.
Multiple vulnerabilities affect Cisco Catalyst SD-WAN products, with CISA reporting active exploitation of CVE-2026-20127 and CVE-2022-20775 by malicious cyber actors targeting organizations globally. The most critical flaw (CVE-2026-20127) allows unauthenticated remote attackers to bypass peering authentication mechanisms and obtain administrative privileges on SD-WAN Controller and Manager systems. Attackers have been observed chaining this zero-day with CVE-2022-20775 for privilege escalation to establish long-term persistence.
The vulnerability set includes five additional flaws affecting Cisco Catalyst SD-WAN Manager across multiple versions. CVE-2026-20129 permits unauthenticated API access with netadmin privileges, while CVE-2026-20126 allows authenticated local users to escalate to root. Additional vulnerabilities enable sensitive information disclosure (CVE-2026-20133), arbitrary file overwrites (CVE-2026-20122), and credential exposure through the Data Collection Agent feature (CVE-2026-20128). Affected versions span 20.9 through 20.18, with several EOL versions also vulnerable.
Cisco has released patches for supported versions, with some fixes scheduled for February 27, 2026. CISA's inclusion of these CVEs in the KEV catalog underscores the severity and active threat landscape. Organizations running Cisco Catalyst SD-WAN should prioritize patching, implement network segmentation, and review systems for indicators of compromise given confirmed exploitation in the wild.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-catalyst-sd-wan-products-could-allow-for-authentication-bypass_2026-016
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs