DaystoPatch

CiscoExploited incident

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (UAT-8616 campaign)

CVE-2026-20127Critical, CVSS 10.0In CISA's Known Exploited Vulnerabilities catalog since 25 Feb 2026

  • Exploited before a fix
FixedFixed for every supported version 33 hours after the first public report.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
0h
First public report to first fix
Follow-through
33h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco PSIRT advisory cisco-sa-sdwan-rpa-EHchtZk, v1.0 (Wayback snapshot 2026-02-25)CuratedQuote verified

    The Cisco PSIRT is aware of limited exploitation of this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.

    v1.0 'First Published: 2026 February 25 16:00 GMT'. Reported to Cisco by the Australian Signals Directorate's ACSC.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:588bc48573261d7d…
    Used in metrics
    Yes
    Dispute this timestamp
    7 more sources for this moment
    CISA KEV (CVE-2026-20127)ClaimedQuote verified25 Feb 2026

    Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

    Added to CISA's KEV catalog on 2026-02-25.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco Talos blog: UAT-8616 (Wednesday, February 25, 2026)CuratedQuote verified25 Feb 2026

    After the discovery of active exploitation of the 0-day in the wild, we were able to find evidence that the malicious activity went back at least three years (2023).

    Post dated 'Wednesday, February 25, 2026 11:13' with no time zone, so day precision. Published alongside the advisory; it also reports the actor 'reportedly exploited CVE-2022-20775' after a software downgrade.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:75585dc8f050a53f…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-20127ClaimedQuote verified25 Feb 2026, 16:14 UTC

    A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:99165ac542fda1b4…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet25 Feb 2026, 16:18 UTC

    Cisco Talos is tracking the active exploitation of CVE-2026-20127, a vulnerability in Cisco Catalyst SD-WAN Controller, formerly vSmart, that allows an unauthenticated remote attacker to bypass authentication and obtain administrative

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet26 Feb 2026, 07:35 UTC

    Si vous administrez une infrastructure réseau utilisant Cisco Catalyst SD-WAN , une vulnérabilité critique actuellement exploitée sur Internet permet à un attaquant distant sans authentification

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Research: gtiClaimedQuote verified24 Jun 2026

    build secure tunnels to facilitate safe data transport. Additional Vulnerabilities in Cisco Catalyst SD-WAN Controllers CVE-2026-20127 and CVE-2026-20182 are critical vulnerabilities recently disclosed by Cisco that affect the peering authentication mechanism for Cisco Catalyst SD-WAN controllers.

    Earliest mention we hold (a vetted outlet).

    Source
    Research: gti research
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1795a465fad9f52e…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet27 Jul 2026, 21:47 UTC

    https://app.opencve.io/cve/CVE-2026-20181 . One from earlier this year: https://app.opencve.io/cve/CVE-2026-20079 . Or this one: https://app.opencve.io/cve/CVE-2026-20127 . How about this one: https://app.opencve.io/cve/CVE-2026-20182 . Commercial networking equipment security is a joke. Find m

    Earliest third-party post we hold.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco PSIRT advisory cisco-sa-sdwan-rpa-EHchtZkCuratedQuote verified

    First Published: 2026 February 25 16:00 GMT

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f0c2c75b2c5c5df7…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    at disclosure

    Cisco PSIRT advisory cisco-sa-sdwan-rpa-EHchtZk, v1.0 (Wayback snapshot 2026-02-25)CuratedQuote verified

    However, as a mitigation customers may use the following guidance to temporarily mitigate the impact of this vulnerability while they are planning to upgrade to a first fixed release.

    Mitigation: restrict traffic to ports 22 and 830 on the control components to known controller IPs via ACLs/firewall rules. Revision 1.2 (CSAF 2026-03-03T00:38:56+00:00) 'Updated mitigation information.'

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:588bc48573261d7d…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    at disclosure

    Cisco PSIRT advisory cisco-sa-sdwan-rpa-EHchtZk, v1.0 (Wayback snapshot 2026-02-25)CuratedQuote verified

    Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

    v1.0 fixed releases: 20.12.5.3 / 20.12.6.1, 20.15.4.2, 20.18.2.1 available; the 20.9 train was listed as '20.9.8.2 (Estimated release February 27, 2026)'.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:588bc48573261d7d…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    +33h

    Cisco CSAF for cisco-sa-sdwan-rpa-EHchtZk, revision 1.1.0CuratedQuote verified

    Updated the fixed releases table. Added the link to a public remediation document.

    CSAF revision 1.1.0 is dated 2026-02-27T00:41:24+00:00. The Wayback snapshot of 2026-02-28 (v1.1, 'Last Updated: 2026 February 27 00:41 GMT') lists 20.9 -> 20.9.8.2 without the 'Estimated release' caveat, so the last supported train had a fix by then.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:413ec4da0b1ad0dc…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. cisco-sa-sdwan-rpa-EHchtZk

    Recorded in the revision history

    Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

    Version table: 2 rows added and 2 rows removed. One new row reads "20.9 | 20.9.8.2".

    • Fixed versions
    Version table rows
    Before20.9 | 20.9.8.2 (Estimated release February 27, 2026); 20.12.5 20.12.6 | 20.12.5.3 20.12.6.1
    After20.9 | 20.9.8.2; 20.12 | 20.12.5.3 20.12.6.1
    Earlier version captured 25 Feb 2026, 19:12 UTC: archived copyLater version captured 28 Feb 2026, 01:06 UTC: archived copyRecovered from archived copiesSnapshots 0613fb1cac… and 9fe2941065…Incident page

Send this to your boss

Cisco SD-WAN zero-day exploited since 2023; fixes for all trains by Feb 27

A maximum-severity authentication bypass in Cisco Catalyst SD-WAN control components was exploited as a zero-day for about three years before Cisco disclosed and fixed it in February 2026.

In plain words

Cisco's SD-WAN controllers, which direct traffic for all of our branch routers, had a flaw that let an outsider log in with high privileges, and government and Cisco investigators found that an advanced group had been using it since 2023. Cisco announced and fixed it on 25 February 2026, with fixes for every supported version available by 27 February. If we run these controllers ourselves, we need to upgrade them and check them for signs of past intrusion, because Talos traced the activity back to 2023.

What happened and who is affected

What happened

On 25 February 2026 Cisco disclosed CVE-2026-20127, a flaw in the peering authentication of Cisco Catalyst SD-WAN Controller, Manager and Validator, scored 10.0, which lets an unauthenticated attacker log in with high privileges and change the SD-WAN fabric's configuration. Cisco Talos reported that an actor it tracks as UAT-8616 had exploited it since at least 2023, and reportedly gained root by downgrading the software and exploiting an older, already-fixed bug (CVE-2022-20775). Fixes for most trains shipped on 25 February and for the 20.9 train by 27 February. CISA added both CVEs to its Known Exploited Vulnerabilities catalog the same day.

Who is affected

Self-managed Cisco Catalyst SD-WAN Controller (vSmart), Manager (vManage) and Validator (vBond) on releases before 20.9.8.2, 20.12.5.3 / 20.12.6.1, 20.15.4.2 and 20.18.2.1; trains earlier than 20.9 and other end-of-maintenance trains must migrate. CVE-2022-20775 affects SD-WAN releases fixed in 2022 and matters when an attacker can downgrade the software.

CVE-2026-20127. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/cisco-cve-2026-20127/

Affected products

  • Cisco Catalyst SD-WAN Controller
  • Cisco Catalyst SD-WAN Manager
  • Cisco Catalyst SD-WAN Validator
How we built this timeline

R7 (correction pass 23 Oct 2026): CVE-2022-20775 is no longer grouped here. Talos reports UAT-8616 chained it with CVE-2026-20127 (software downgrade, then CVE-2022-20775 for root), but it was disclosed and fixed on 28 Sep 2022, more than 14 days apart, so it is tracked separately as cisco-cve-2022-20775. exploited before a fix=true: Talos found activity going back to 2023, before the 25 Feb 2026 fix.

CISA issued Emergency Directive ED 26-03 for Cisco SD-WAN and added both CVEs to KEV on 25 Feb 2026. Later SD-WAN zero-days in 2026: cisco-cve-2026-20182 (May), cisco-cve-2026-20245 (June), cisco-cve-2026-76504 (September).

Related

Cisco report card