CVE-2026-20127
Published: 25 February 2026
Description
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This…
more
vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely remediation of known flaws like the improper peering authentication bypass in Cisco SD-WAN controllers.
Ensures devices such as SD-WAN controllers authenticate mutually before communications, preventing peering authentication bypass by remote attackers.
Monitors and controls external communications to block crafted requests from unauthenticated remote attackers targeting the vulnerable peering service.
Security SummaryAI
CVE-2026-20127 is a critical vulnerability (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) affecting the peering authentication mechanism in Cisco Catalyst SD-WAN Controller, formerly known as SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage. The issue stems from the peering authentication not functioning properly (CWE-287: Improper Authentication), enabling an unauthenticated remote attacker to bypass authentication controls and gain administrative privileges on affected systems.
An unauthenticated remote attacker can exploit this vulnerability by sending crafted requests to a vulnerable system. Successful exploitation allows the attacker to log in using an internal high-privileged non-root user account, providing access to NETCONF services. From there, the attacker can manipulate network configurations across the SD-WAN fabric, potentially disrupting operations or enabling further compromise.
The Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk provides details on affected versions, exploitation status, and recommended mitigations or patches. This vulnerability is also listed in CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127, indicating real-world exploitation and requiring urgent remediation by federal agencies.
Published on 2026-02-25, this flaw underscores risks in SD-WAN management platforms, with its perfect CVSS score highlighting the need for immediate patching in enterprise environments.
Details
- CWE(s)
- KEV Date Added
- 25 February 2026
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables an unauthenticated remote attacker to bypass authentication on a network-accessible SD-WAN management platform (AV:N/PR:N), directly facilitating exploitation of a public-facing application.