CVE-2026-20127
Published: 25 February 2026
Summary
CVE-2026-20127 is a critical-severity Improper Authentication (CWE-287) vulnerability in Cisco Catalyst Sd-Wan Manager. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-3 (Device Identification and Authentication).
Deeper analysis
CVE-2026-20127 is a critical vulnerability (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) affecting the peering authentication mechanism in Cisco Catalyst SD-WAN Controller, formerly known as SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage. The issue stems from the peering authentication not functioning properly (CWE-287: Improper Authentication), enabling an unauthenticated remote attacker to bypass authentication controls and gain administrative privileges on affected systems.
An unauthenticated remote attacker can exploit this vulnerability by sending crafted requests to a vulnerable system. Successful exploitation allows the attacker to log in using an internal high-privileged non-root user account, providing access to NETCONF services. From there, the attacker can manipulate network configurations across the SD-WAN fabric, potentially disrupting operations or enabling further compromise.
The Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk provides details on affected versions, exploitation status, and recommended mitigations or patches. This vulnerability is also listed in CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127, indicating real-world exploitation and requiring urgent remediation by federal agencies.
Published on 2026-02-25, this flaw underscores risks in SD-WAN management platforms, with its perfect CVSS score highlighting the need for immediate patching in enterprise environments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8675
Vulnerability details
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain…
more
administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
- CWE(s)
- KEV Date Added
- 25 February 2026
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables an unauthenticated remote attacker to bypass authentication on a network-accessible SD-WAN management platform (AV:N/PR:N), directly facilitating exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authenticated access decisions so the broken peering mechanism cannot grant the high-privileged account or subsequent NETCONF configuration changes.
Requires cryptographic or mutual device authentication for SD-WAN component peering, directly closing the CWE-287 flaw that allows unauthenticated crafted requests.
Mandates identification and authentication of users before granting the internal privileged account that the vulnerability exposes.