CISA Issues Emergency Directive Over Exploited Cisco SD
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator A flaw in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond) allows an unauthenticated, remote attacker to bypass authentication by sending crafted requests to an affected system. A successful exploit grants the attacker access as an internal, high-privileged, non-root user on the SD-WAN Controller, from which they can reach NETCONF and manipulate the network configuration of the entire SD-WAN fabric. Any organization operating these Cisco SD-WAN control-plane components is affected, and the critical CVSS 10.0 score reflects full network scope with no privileges or user interaction required. The flaw is confirmed exploited in the wild: CISA added it to the KEV on 2026-02-25, Cisco has confirmed active exploitation (including a compromise of a communications service provider), and Five Eyes allies have issued an active-exploitation warning, with EPSS at 88.2% (100th percentile). Do: Upgrade affected Catalyst SD-WAN Controller, Manager, and Validator components per Cisco's PSIRT advisory (fixed versions are not specified in this data), and prioritize patching given confirmed in-the-wild exploitation. Follow CISA Emergency Directive 26-03 and the CISA Hunt & Hardening Guidance for Cisco SD-WAN Devices: hunt for compromise indicators such as unexpected high-privileged non-root logins and unauthorized NETCONF configuration changes, and restrict internet exposure of SD-WAN management interfaces. Where mitigations are unavailable, adhere to applicable BOD 22-01 cloud guidance or discontinue use of the product. | 10.0 | 88% | KEV |
| large≈10,000–100,000 controller/manager/validator deployments across enterprise and service-provider SD-WAN fabrics (Cisco SD-WAN is a market-leading enterprise… |
Full article434 words · extracted from infosecurity-magazine.com · click to collapse
A newly issued emergency directive from the US Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting vulnerabilities in Cisco Catalyst SD-WAN infrastructure used across US federal networks.
The directive, known as Emergency Directive 26-03, orders federal agencies to urgently identify affected systems, collect forensic evidence, apply security updates and investigate potential compromises.
The warning centers on a flaw tracked as CVE-2026-20127, described as a critical authentication bypass vulnerability with a CVSS severity score of 10. Security officials say the bug could allow an unauthenticated attacker to obtain administrative access to SD-WAN infrastructure.
Such access could enable threat actors to manipulate network configurations or disrupt traffic across government systems. The affected technology is widely used to manage distributed enterprise networks, meaning successful exploitation could grant attackers broad control over key communications infrastructure.
Agencies Ordered to Collect Evidence and Patch Systems
Federal agencies must carry out a sequence of actions under the directive:
-
Identify all affected Cisco SD-WAN systems and submit an inventory to CISA
-
Configure devices to store logs externally and collect forensic artifacts
-
Apply vendor security updates addressing the listed vulnerabilities
-
Hunt for evidence of compromise and rebuild infrastructure if root access is detected
-
Report remediation and logging actions to CISA by multiple deadlines through March 23, 2026
The directive also requires agencies to provide logging data through CISA’s Cloud Logging Aggregation Warehouse program, allowing investigators to analyze activity across networks. The requirements apply to federal civilian executive branch systems, including IT environments operated directly by agencies and those hosted by third-party providers on their behalf.
Directive Signals Ongoing Investigation Into Exploitation
Security specialists say the directive’s emphasis on artifact collection and centralized logging suggests investigators are working to determine how widely the vulnerabilities may have been used.
“CISA has clear reason to believe that these vulnerabilities have been, and likely continue to be, exploited by threat actors to compromise government systems and networks,” Bobby Kuzma, director of offensive operations at ProCircular, said. “The requests for artifact collection and submission make it clear they’re working to identify the scope of the threat.
“While contractors and civilian organizations are not required or requested to follow similar collection steps, if you have Cisco SD-WAN appliances in your environment, this is a good time to collect artifacts and review patch statuses and logs,” Kuzma added.
Federal agencies are required by law to comply with emergency directives issued by CISA when significant cybersecurity threats to government systems are identified.
Image credit: PJ McDonnell / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/cisa-cisco-sd-wan-flaws-directive/