Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass (CVE-2026-20127)

Historical catalog analysis: CISA added this entry on February 25, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-20127 is an authentication bypass vulnerability affecting the peering authentication mechanism within Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage). A remote, unauthenticated attacker could send crafted requests to a vulnerable system to bypass security checks. If successful, the attacker can obtain administrative privileges as an internal, high-privileged, non-root user account. This level of access allows for the use of NETCONF to manipulate network configurations across the SD-WAN fabric.

Exposure and applicability

This vulnerability applies to organizations deploying Cisco Catalyst SD-WAN Controller and Manager. The exposure path is remote and unauthenticated, meaning an attacker does not need existing credentials to initiate the bypass. Because the resulting access grants control over NETCONF, the risk extends beyond a single device to the integrity of the broader SD-WAN fabric configuration.

Remediation priorities

Based on the reported vulnerability, our analysis suggests prioritizing the following actions for infrastructure owners:

1. Immediate Exposure Assessment: Identify all instances of Catalyst SD-WAN Controller and Manager within the environment. Given the remote nature of the bypass, these assets should be prioritized for immediate review.
2. Implementation of Hardening Guidance: Follow the specific technical steps outlined in CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices” and Emergency Directive 26-03. These documents provide the necessary framework for reducing exposure beyond simple version checks.
3. NETCONF Access Restriction: Review and restrict access to NETCONF interfaces. Since this is the primary vector for fabric manipulation following a successful bypass, limiting who can reach these interfaces could reduce the potential impact of an exploit.

How to validate remediation

Verification must go beyond confirming a software version or patch level. To ensure exposure has been reduced, defenders should:

• Audit Peering Authentication: Verify that the peering authentication mechanism is functioning as intended according to the vendor’s updated security specifications.
• Validate Hardening State: Use the CISA Hunt & Hardening Guidance to perform a state-based check of the device configuration to ensure hardening measures are active and correctly applied.
• Verify Interface Isolation: Confirm that NETCONF access is restricted to authorized management segments, ensuring that an unauthenticated remote request cannot reach the vulnerable service from untrusted zones.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in ransomware campaigns. Additionally, while CISA provided a strict deadline for federal agencies (2026-02-27), non-federal organizations must determine their own risk appetite and remediation timeline based on their specific fabric exposure. A significant residual risk exists if hardening guidance is applied without verifying the actual state of the peering authentication mechanism, as configuration errors could leave the bypass path open despite the presence of a patch.

Source and editorial note

CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability · Source date: February 25, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: February 28, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 19, 2026 at 00:43 UTC.

Request a Vulnerability Assessment