Cisco’s advisory for CVE-2026-20127, a CVSS 10.0 authentication bypass in Catalyst SD-WAN, now lists the Controller, Manager and Validator as affected and says the company knows of limited exploitation.
The advisory was first published on February 25 and last updated on October 28 (version 2.1). Cisco says the flaw sits in peering authentication, which “is not working properly” on affected systems, so an unauthenticated remote attacker can send crafted requests, obtain administrative privileges and log in to a Controller as an internal, high-privileged, non-root account. From there the attacker could reach NETCONF and change the network configuration for the SD-WAN fabric.
All three components are affected regardless of device configuration, on premises and in Cisco-hosted SD-WAN cloud deployments. Cisco says no workaround exists. The first fixed releases are 20.9.8.2 for 20.9, 20.12.5.3 or 20.12.6.1 for 20.12, 20.15.4.2 for 20.15 and 20.18.2.1 for 20.18. Cisco marks 20.11, 20.13, 20.14 and 20.16 as having reached end of software maintenance and points them to the next listed fixed release, and releases earlier than 20.9 must migrate to a fixed release.
The advisory gives defenders a log check. Cisco asks customers to audit /var/log/auth.log on Controllers for “Accepted publickey for vmanage-admin” entries from unknown or unauthorized IP addresses, and to compare each address with the System IPs in the Manager web UI. It also says every control connection peering event needs manual validation, especially vmanage peer types and unrecognized public IPs. Customers who suspect compromise should run the request admin-tech command on each control component and open a Cisco TAC case. The advisory links to a Cisco Talos post on the activity.
In our reading, the Validator listing is the item to check, because a patch plan scoped only to Controllers and Managers leaves it out. Earlier SD-WAN coverage is in our brief on the SD-WAN Manager authentication bypass, and the case for rebuilding an exploited appliance is in our opinion on edge appliances.
