CVE-2026-20127
Lets attackers bypass authentication and gain admin privileges in Cisco SD-WAN
A critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, Manager, and Validator allows unauthenticated remote attackers to gain administrative privileges. The flaw is being actively exploited, and CISA has added it to its known-exploited list. Cisco later released patches for a related zero-day, but attackers continue to target the platform.
Cisco Catalyst SD-WAN Controller and Manager · Updated 29 Oct · From 2 of our stories and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 25 Feb; US agencies must fix by 27 Feb
SeveritycriticalCVSS 10.0 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Apply the latest security updates from Cisco as soon as they are available.
- If updates are not yet available, restrict network access to affected systems to trusted IPs only.
- Monitor for unusual activity using guidance from Cisco Talos.
- For additional protection, follow CISA's remediation deadlines.
What happened
- 25 FebCISA adds CVE-2026-20127 to the known-exploited list, requiring federal agencies to fix by February 27, 2026.
- 30 SeptCisco releases security updates for a critical zero-day in SD-WAN Manager tracked as CVE-2026-76504.
- 28 OctReports emerge of Volt Typhoon using the 'Silent Train' framework in zero-day attacks.
- 29 OctResearchers observe hackers exploiting a patched Cisco SD-WAN vulnerability to deploy the KeyDrift malware framework.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-20127 | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability | critical 10.0 | 25 Feb | 89% |
Our reporting
29 OctHackers exploit Cisco SD-WAN flaw to deploy 'KeyDrift' malware, researchers say30 SeptCisco Patches Actively Exploited Critical Zero-Day in SD-WAN ManagerReported elsewhere
BleepingComputer · 29 OctHackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware ↗BleepingComputer · 28 OctVolt Typhoon hides zero-day attacks using 'Silent Train' framework ↗Cisco · 28 OctCisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability ↗The records
CISA known-exploited catalog ↗CVE-2026-20127 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works