2026-002: Multiple Vulnerabilities in Cisco Products
Cisco fixed SD-WAN Controller auth bypass CVE-2026-20127 (CVSS 10) exploited in the wild since 2023, plus several critical and high flaws in SD-WAN Manager.
On 25 February 2026 Cisco released advisories for multiple flaws in Catalyst SD-WAN Controller and SD-WAN Manager, potentially granting administrative access to attackers. CVE-2026-20127 (CVSS 10.0) is an authentication bypass in the Controller's peering authentication mechanism, exploited in the wild since 2023, allowing unauthenticated admin access via NETCONF, rogue device injection, and persistent access. SD-WAN Manager flaws include CVE-2026-20129 (9.8, unauthenticated API auth bypass to netadmin), CVE-2026-20126 (7.8, local privesc to root), CVE-2026-20133 (7.5, info disclosure), CVE-2026-20122 (7.1, arbitrary file overwrite), and CVE-2026-20128 (5.5, DCA info disclosure). CERT-EU recommends patching, capturing forensic evidence, IOC hunting, and restricting management-plane internet exposure.
- CVE-2026-20127 (CVSS 10): SD-WAN Controller auth bypass to admin, exploited in the wild since 2023
- CVE-2026-20129 (CVSS 9.8): unauthenticated API auth bypass in SD-WAN Manager
- Other flaws: root privesc (7.8), info disclosure (7.5/5.5), file overwrite (7.1)
- Exploitation enables rogue SD-WAN devices, config changes, and persistent access
- Cisco and CERT-EU advise forensic evidence capture, IOC hunting, and patching
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20122 | Arbitrary File Overwrite via Privileged APIs in Cisco Catalyst SD-WAN Manager | 5.4 | 26% | KEV | KEV |
CVE-2026-20133+3 related CVEs | Actively Exploited Information Disclosure in Cisco Catalyst SD-WAN Manager | 7.5 group max | 31% | KEV | KEV |
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
From the original article
5 min read at cert.europa.eu
On 25 February 2026, Cisco released security advisories addressing multiple high and critical severity vulnerabilities in Cisco Catalyst SD-WAN controllers and Cisco SD-WAN Manager. If exploited, these vulnerabilities could allow attackers to gain administrative access to compromised systems. It is recommended to capture forensic evidence, hunt for indicators of compromise, and apply updates as soon as possible.
cert.europa.eu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.