CVE-2026-20127
Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
Description
CVE-2026-20127 is a critical authentication bypass vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Controller (formerly Cisco SD-WAN vSmart Controller) and Cisco Catalyst SD-WAN Manager (formerly Cisco SD-WAN vManage). Scoring the maximum CVSS v3.1 base score of 10.0, this vulnerability allows an unauthenticated, remote attacker to gain unauthorized access to the system by sending crafted requests to a specific API endpoint that lacks sufficient request validation. Successful exploitation enables the attacker to execute arbitrary commands and make configuration changes on the compromised device, effectively taking complete control of the SD-WAN management plane. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation and mandating urgent remediation. With an EPSS score of 4.68% at the 90th percentile, this vulnerability represents a significant threat to enterprise network infrastructure worldwide.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | catalyst sd-wan manager | < 20.9.8.2; >= 20.11, < 20.12.5.3; >= 20.13, < 20.15.4.2; >= 20.16, < 20.18.2.1; 20.12.6 |
| cisco | sd-wan vbond orchestrator | < 20.9.8.2; >= 20.11, < 20.12.5.3; >= 20.13, < 20.15.4.2; >= 20.16, < 20.18.2.1; 20.12.6 |
| cisco | sd-wan vsmart controller | < 20.9.8.2; >= 20.11, < 20.12.5.3; >= 20.13, < 20.15.4.2; >= 20.16, < 20.18.2.1; 20.12.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
Weakness Type
CWE-287: Improper Authentication
CVE-2026-20127 is classified under CWE-287 (Improper Authentication). This weakness occurs when software does not properly verify the identity of an actor claiming a specific identity before granting access to protected resources. In the case of this vulnerability, the API endpoint on the Cisco Catalyst SD-WAN management interface fails to enforce adequate authentication checks on incoming requests. As a result, an attacker who crafts a request in the expected format can bypass the authentication mechanism entirely and interact with the API as if they were an authorized administrator. This is among the most dangerous weakness categories because it allows complete circumvention of access controls without requiring any credentials or prior access.
Impact Analysis
The impact of CVE-2026-20127 is catastrophic across all dimensions of the CIA triad, reflected in its perfect CVSS score of 10.0. Confidentiality is completely compromised because an unauthenticated attacker gains full administrative access, enabling them to read all configuration data, view network topologies, extract VPN keys, access stored credentials, and enumerate the entire SD-WAN fabric including all connected edge devices and their configurations.
Integrity faces maximum impact as the attacker can modify any configuration on the SD-WAN Controller or Manager. This includes altering routing policies, changing security policies, reconfiguring VPN tunnels, deploying unauthorized device templates, and potentially pushing malicious configurations to all managed edge devices across the entire SD-WAN deployment. The scope metric is Changed (S:C), meaning the attacker can affect resources beyond the vulnerable component itself, as compromised controllers can push configurations to all managed SD-WAN edge devices.
Availability is fully at risk since the attacker can disrupt the management plane, disable services, or push configurations that cause network outages across the entire SD-WAN infrastructure. The attack requires no user interaction (UI:N), has low complexity (AC:L), and needs no prior privileges (PR:N), making it exploitable by any attacker with network access to the management interface. In scenarios where the management interface is exposed to the internet, the risk is particularly acute.
Exploit Maturity
CVE-2026-20127 is confirmed as actively exploited, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of February 27, 2026. The EPSS score of 4.68% at the 90th percentile places this vulnerability significantly above average in terms of exploitation likelihood, indicating that threat actors are actively targeting this flaw.
The Cisco security advisory (cisco-sa-sdwan-auth-bypass-lnHkfHBq) documents the vulnerability in detail. The combination of a network-accessible attack vector, no authentication requirement, and full system compromise makes this vulnerability extremely attractive to attackers, including state-sponsored groups and ransomware operators seeking to compromise enterprise network infrastructure. Although the ransomware association is currently classified as unknown by CISA, the level of access gained through exploitation would readily support ransomware deployment across managed network segments.
Remediation
Emergency patching is imperative. Organizations must upgrade Cisco Catalyst SD-WAN Manager and Cisco Catalyst SD-WAN Controller to version 20.12.5 or later immediately. All versions from 17.2 up to 20.12.5 are affected, which encompasses a very broad range of deployments. Cisco has published detailed upgrade instructions in advisory cisco-sa-sdwan-auth-bypass-lnHkfHBq.
Network access restriction must be implemented as an immediate compensating control. Ensure that the web-based management interface is not accessible from the internet or any untrusted network. Use firewall rules, access control lists, and dedicated management VLANs to restrict access to the management interface to only authorized administrator workstations. This single control can significantly reduce the risk of exploitation while patches are being tested and deployed.
Incident response investigation should be conducted before and after patching. Review web server access logs, API logs, and authentication logs for indicators of unauthorized access, particularly requests to the affected API endpoint from unknown or external IP addresses. Check for unauthorized configuration changes, new user accounts, or modified security policies that may indicate prior compromise.
Credential rotation for all administrative accounts on the SD-WAN Controller and Manager should be performed after patching, as any credentials stored on or accessible through a compromised system must be considered potentially exposed. This includes local accounts, API tokens, certificate private keys, and any integrated authentication credentials.
Technical Details
CVE-2026-20127 targets a specific API endpoint in the web-based management interface of Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which represents the worst possible combination of attack characteristics: network-accessible, low complexity, no privileges required, no user interaction needed, and changed scope with maximum impact across all three CIA dimensions.
The vulnerability exists because the affected API endpoint does not properly validate the authenticity and authorization of incoming requests. When the management interface receives a crafted HTTP request to this endpoint, it processes the request without verifying that the requester has valid credentials or appropriate permissions. The insufficient validation allows an unauthenticated attacker to invoke administrative functions through the API, including command execution and configuration management.
The scope is classified as Changed (S:C), which is significant because it means that compromising the SD-WAN Controller or Manager can impact other components in the network. In a typical SD-WAN deployment, the controller and manager serve as the centralized management and orchestration plane for potentially hundreds or thousands of edge devices. An attacker who gains unauthorized access to these systems can push malicious configurations, modify routing behavior, disable security controls, or exfiltrate data across the entire managed network.
Affected versions span from 17.2 through all releases before 20.12.5 for both Cisco Catalyst SD-WAN Manager and Cisco Catalyst SD-WAN Controller. The fix in version 20.12.5 introduces proper request authentication and validation on the affected API endpoint, ensuring that all requests are verified against the authentication subsystem before being processed.
Frequently Asked Questions
What is CVE-2026-20127?
CVE-2026-20127 is a critical authentication bypass vulnerability in the Cisco Catalyst SD-WAN Controller and Manager web management interface. It allows unauthenticated remote attackers to gain full system access by sending crafted requests to an improperly validated API endpoint.
Why is CVE-2026-20127 rated CVSS 10.0?
It receives the maximum score because it is remotely exploitable over the network with low complexity, requires no authentication or user interaction, has changed scope affecting downstream devices, and results in complete compromise of confidentiality, integrity, and availability.
Which versions of Cisco Catalyst SD-WAN are affected?
All versions of Cisco Catalyst SD-WAN Manager and Cisco Catalyst SD-WAN Controller from version 17.2 up to (but not including) version 20.12.5 are vulnerable. Organizations should upgrade to 20.12.5 or later.
How can I protect my network from CVE-2026-20127?
The primary fix is upgrading to Cisco Catalyst SD-WAN version 20.12.5 or later. As an immediate compensating control, restrict network access to the management interface so that it is only reachable from trusted administrator networks.
Is CVE-2026-20127 being actively exploited?
Yes. CISA has confirmed active exploitation by adding this vulnerability to the Known Exploited Vulnerabilities catalog. Its EPSS score of 4.68% at the 90th percentile further indicates elevated exploitation activity.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.