10

CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

CVSS: 10.0v3.1CriticalKEVAnalyzed
Published 25-02-2026Last modified 16-06-2026
Open JSON

Vulnerability summary

CVE-2026-20127 is a critical (CVSS 10.0) Improper Authentication vulnerability in Cisco Catalyst SD-WAN Controller and Manager. It is known to be exploited: CISA lists it, first on 25-02-2026. EPSS estimates a 88.48% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
88.48%
0%100%
Critical · +0.23 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits1metasploit

Timeline

  1. 25-02-2026
    PublishedVulnerability first disclosed.
  2. 25-02-2026
    Added to CISA KEVCisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
  3. 27-02-2026
    CISA remediation dueApply mitigations per vendor instructions.
  4. 16-06-2026
    Last modifiedVulnerability information updated.

Description

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

88.48%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+0.23 pp

From 88.24% on 18-09-2026

18-09-202618-10-2026
EPSS score
88.48%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
25-02-2026
Federal due date
27-02-2026

CISA required action

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. www.cisa.gov/news-events/… sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk nvd.nist.gov/vuln/detail/CVE-2026-20127

Public exploits

1 found
  • MetasploitMetasploitremoteUnverified

    Cisco Catalyst SD-WAN Controller Authentication Bypass

    auxiliary/admin/networking/cisco_sdwan_auth_bypass

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Cisco4 products
  • catalyst_sd-wan_manager< 20.9.8.2 | ≥ 20.11, < 20.12.5.3 | ≥ 20.13, < 20.15.4.2 | ≥ 20.16, < 20.18.2.1 | 20.12.6
  • cisco catalyst sd-wan manager20.1.12 | 19.2.1 | 18.4.4 | 18.4.5 | 20.11.1 | 20.1.1 | 19.3.0 | 19.2.2 | 19.2.099 | 18.3.6 | 18.3.7 | 19.2.0 | 18.3.8 | 19.0.0 | 19.1.0 | 18.4.302 | 18.4.303 | 19.2.097 | 19.2.098 | 17.2.10 | 18.3.6.1 | 19.0.1a | 18.2.0 | 18.4.3 | 18.4.1 | 17.2.8 | 18.3.3.1 | 18.4.0 | 18.3.1 | 17.2.6 | 17.2.9 | 18.3.4 | 17.2.5 | 18.3.1.1 | 18.3.5 | 18.4.0.1 | 18.3.3 | 17.2.7 | 17.2.4 | 18.3.0 | 19.2.3 | 18.4.501_ES | 20.3.1 | 20.1.2 | 19.2.929 | 19.2.31 | 20.3.2 | 19.2.32 | 20.3.2_925 | 20.3.2.1 | 20.3.2.1_927 | 18.4.6 | 20.1.2_937 | 20.4.1 | 20.3.2_928 | 20.3.2_929 | 20.4.1.0.1 | 20.3.2.1_930 | 19.2.4 | 20.5.0.1.1 | 20.4.1.1 | 20.3.3 | 19.2.4.0.1 | 20.3.2_937 | 20.3.3.1 | 20.5.1 | 20.1.3 | 20.3.3.0.4 | 20.3.3.1.2 | 20.3.3.1.1 | 20.4.1.2 | 20.3.3.0.2 | 20.4.1.1.5 | 20.4.1.0.01 | 20.4.1.0.02 | 20.3.3.1.7 | 20.3.3.1.5 | 20.5.1.0.1 | 20.3.3.1.10 | 20.3.3.0.8 | 20.4.2 | 20.4.2.0.1 | 20.3.4 | 20.3.3.0.14 | 19.2.4.0.8 | 19.2.4.0.9 | 20.3.4.0.1 | 20.3.2.0.5 | 20.6.1 | 20.5.1.0.2 | 20.3.3.0.17 | 20.6.1.1 | 20.6.0.18.3 | 20.3.2.0.6 | 20.6.0.18.4 | 20.4.2.0.2 | 20.3.3.0.16 | 20.3.4.0.5 | 20.6.1.0.1 | 20.3.4.0.6 | 20.6.2 | 20.7.1EFT2 | 20.3.4.0.9 | 20.3.4.0.11 | 20.4.2.0.4 | 20.3.3.0.18 | 20.7.1 | 20.6.2.1 | 20.3.4.1 | 20.5.1.1 | 20.4.2.1 | 20.4.2.1.1 | 20.3.4.1.1 | 20.3.813 | 20.3.4.0.19 | 20.4.2.2.1 | 20.5.1.2 | 20.3.4.2 | 20.3.814 | 20.4.2.2 | 20.6.2.2 | 20.3.4.2.1 | 20.7.1.1 | 20.3.4.1.2 | 20.6.2.2.2 | 20.3.4.0.20 | 20.6.2.2.3 | 20.4.2.2.2 | 20.3.5 | 20.6.2.0.4 | 20.4.2.2.3 | 20.3.4.0.24 | 20.6.2.2.7 | 20.6.3 | 20.3.4.2.2 | 20.4.2.2.4 | 20.7.1.0.2 | 20.8.1 | 20.3.5.0.8 | 20.3.5.0.9 | 20.4.2.2.8 | 20.3.5.0.7 | 20.6.3.0.7 | 20.6.3.0.5 | 20.6.3.0.10 | 20.6.3.0.2 | 20.7.2 | 20.9.1EFT2 | 20.6.3.0.11 | 20.6.3.1 | 20.6.3.0.14 | 20.6.4 | 20.9.1 | 20.6.3.0.19 | 20.6.3.0.18 | 20.3.6 | 20.9.1.1 | 20.6.3.0.23 | 20.6.4.0.4 | 20.6.3.0.25 | 20.6.5 | 20.6.3.0.27 | 20.9.2 | 20.9.2.1 | 20.6.3.0.29 | 20.6.3.0.31 | 20.6.3.0.32 | 20.10.1 | 20.6.3.0.33 | 20.9.2.0.01 | 20.9.1_LI_Images | 20.10.1_LI_Images | 20.9.2_LI_Images | 20.3.7 | 20.9.3 | 20.6.5.1 | 20.11.1_LI_Images | 20.9.3_LI_ Images | 20.6.3.1.1 | 20.9.3.0.2 | 20.6.5.1.2 | 20.9.3.0.3 | 20.4.2.3 | 20.6.3.2 | 20.6.4.1 | 20.6.3.0.38 | 20.6.3.0.39 | 20.3.5.1 | 20.3.4.3 | 20.9.3.1 | 20.3.3.2 | 20.6.5.2 | 20.3.7.1 | 20.10.1.1 | 20.6.5.2.1 | 20.3.4.0.25 | 20.6.2.2.4 | 20.6.1.2 | 20.11.1.1 | 20.9.3.0.5 | 20.3.4.0.26 | 20.6.5.1.3 | 20.6.3.0.40 | 20.13.1 | 20.9.2.2 | 20.6.5.2.3 | 20.6.5.1.4 | 20.6.5.3 | 20.6.3.0.41 | 20.9.3.0.7 | 20.6.5.1.5 | 20.9.3.0.4 | 20.6.4.0.19 | 20.6.5.1.6 | 20.9.3.0.8 | 20.6.3.3 | 20.3.7.2 | 20.6.5.4 | 20.6.5.1.7 | 20.9.3.0.12 | 20.6.4.2 | 20.6.5.5 | 20.9.3.2 | 20.11.1.2 | 20.6.3.4 | 20.10.1.2 | 20.6.5.1.9 | 20.9.3.0.16 | 20.6.3.0.45 | 20.6.5.1.10 | 20.9.3.0.17 | 20.6.5.2.4 | 20.6.4.0.21 | 20.9.3.0.18 | 20.6.3.0.46 | 20.6.3.0.47 | 20.9.2.3 | 20.9.3.2_LI_Images | 20.9.3.0.21 | 20.9.3.0.20 | 20.9.4_LI_Images | 20.9.4 | 20.6.5.1.11 | 20.12.1 | 20.12.1_LI_Images | 20.6.5.1.13 | 20.9.3.0.23 | 20.6.5.2.8 | 20.9.4.1 | 20.9.4.1_LI_Images | 20.9.3.0.25 | 20.9.3.0.24 | 20.6.5.1.14 | 20.3.8 | 20.6.6 | 20.9.3.0.26 | 20.6.3.0.51 | 20.9.3.0.29 | 20.12.2 | 20.12.2_LI_Images | 20.6.6.0.1 | 20.13.1_LI_Images | 20.9.4.0.4 | 20.9.4.1.1 | 20.9.5 | 20.9.5_LI_Images | 20.12.3_LI_Images | 20.12.3 | 20.9.4.1.3 | 20.6.7 | 20.9.5.1 | 20.9.5.1_LI_Images | 20.9.4.1.6 | 20.14.1 | 20.14.1_LI_Images | 20.9.5.2 | 20.9.5.2.1 | 20.9.5.2_LI_Images | 20.12.3.1 | 20.12.4 | 20.15.1_LI_Images | 20.15.1 | 20.9.5.1.4 | 20.9.5.2.7 | 20.9.5.2.13 | 20.9.6 | 20.9.6_LI_Images | 20.9.5.2.14 | 20.6.8 | 20.12.4.0.03 | 20.16.1 | 20.16.1_LI_Images | 20.12.4_LI_Images | 20.9.5.2.16 | 20.12.4.0.4 | 20.12.401 | 20.9.5.3 | 20.9.5.3_LI_Images | 20.12.4.1_LI_Images | 20.12.4.1 | 20.9.5.2.21 | 20.9.6.0.3 | 20.12.4.0.6 | 20.15.2_LI_Images | 20.15.2 | 20.12.4_Monthly_ES5 | 20.12.5 | 20.12.5_LI_Images | 20.9.7_LI _Images | 20.9.7 | 20.15.3 | 20.15.3_ LI _Images | 20.12.501 | 20.12.5.1_LI_Images | 20.12.5.1 | 20.12.5.2_LI_Images | 20.12.5.2 | 20.15.3.1 | 20.15.4_LI_Images | 20.15.4 | 20.9.7.1_LI _Images | 20.9.7.1 | 20.18.1 | 20.18.1_LI_Images | 20.12.6_LI_Images | 20.12.6 | 20.12.5.1.01 | 20.9.8 | 20.9.8_LI_Images | 20.18.2 | 20.15.4.1_LI_Images | 20.15.4.1 | 20.18.2_LI_Images
  • sd-wan_vbond_orchestrator< 20.9.8.2 | ≥ 20.11, < 20.12.5.3 | ≥ 20.13, < 20.15.4.2 | ≥ 20.16, < 20.18.2.1 | 20.12.6
  • sd-wan_vsmart_controller< 20.9.8.2 | ≥ 20.11, < 20.12.5.3 | ≥ 20.13, < 20.15.4.2 | ≥ 20.16, < 20.18.2.1 | 20.12.6

1 vendor · 4 products

References

2 links