Skip to content
securitytabs

CVE-2026-20127

Critical10.0CISA KEV — exploited in the wild

Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerabilitytitle from the CVE record

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. 

CVSS
10.0v3.1
EPSS (exploit probability)
89.3%100th pct
CISA KEV
Listed

EPSS trendFIRST daily scores, last 90 days

FIRST EPSS rose from 88.5% on 2026-09-27 to 89.3% on 2026-10-28, ranging 88.5%–89.3% across 31 daily scores.
2026-09-27 → 2026-10-28 · 31 days · 88.5%–89.3%
Daily values
FIRST EPSS daily scores for this CVE
Score dateEPSSPercentile
2026-10-2889.3%99.8%
2026-10-2789.3%99.8%
2026-10-2689.3%99.8%
2026-10-2589.3%99.8%
2026-10-2489.3%99.8%
2026-10-2389.3%99.8%
2026-10-2288.5%99.8%
2026-10-2188.5%99.8%
2026-10-2088.5%99.8%
2026-10-1988.5%99.8%
2026-10-1888.5%99.8%
2026-10-1788.5%99.8%
2026-10-1688.5%99.8%
2026-10-1588.5%99.8%
2026-10-1488.5%99.8%
2026-10-1388.5%99.8%
2026-10-1288.5%99.8%
2026-10-1188.5%99.8%
2026-10-1088.5%99.8%
2026-10-0988.5%99.8%
2026-10-0888.5%99.8%
2026-10-0788.5%99.8%
2026-10-0688.5%99.8%
2026-10-0588.5%99.8%
2026-10-0488.5%99.8%
2026-10-0388.5%99.8%
2026-10-0288.5%99.8%
2026-10-0188.5%99.8%
2026-09-3088.5%99.8%
2026-09-2988.5%99.8%
2026-09-2788.5%99.8%

CISA KEV entrycatalogue 2026.10.28

Date added
2026-02-25
Federal due date
2026-02-27
Known ransomware use
Unknown

Required action

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Verbatim from the CISA KEV catalogue (CISA KEV, fetched 2026-10-28 22:23 UTC). The due date applies to US federal agencies under BOD 22-01.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Learn

Why it happened and what stops it

The weakness (CWE)

How attackers use it (ATT&CK)

Typical for this kind of weakness across CISA KEV exploits (CTID), not specific to this CVE.

Controls that mitigate it (NIST SP 800-53)

Affected products

  • cisco catalyst sd-wan manager
  • cisco sd-wan vbond orchestrator
  • cisco sd-wan vsmart controller

Coverage1 article

References

Facts sourced from NVD, FIRST EPSS, and CISA KEV. Last synced 2026-10-28 22:23 UTC.

  • CVSS & description: NVD 2.0, fetched 2026-10-28 22:23 UTC
  • EPSS: FIRST EPSS, fetched 2026-10-28 22:23 UTC; score date 2026-10-28
  • KEV: CISA KEV, fetched 2026-10-28 22:23 UTC