CVE-2026-20127
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Description
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
Response & Mitigation
Why act now?
Prioritisation rationale
CVE-2026-20127 carries a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and sits at the 99.8th EPSS percentile, placing it among the most likely-to-be-exploited vulnerabilities tracked at this time. The attack requires no authentication, no user interaction, and no special network position — any attacker with IP reachability to the management plane can attempt exploitation. For NIS2-scoped organisations in sectors such as energy, transport, telecommunications, and financial infrastructure, the blast radius is severe: a successful compromise grants an attacker full control over SD-WAN fabric configuration, enabling silent rerouting of traffic, dismantling of network segmentation, and modification of encryption policies across the entire WAN. CISA has not flagged known ransomware campaign use at the time of KEV listing, but the combination of a perfect CVSS score, near-certain exploitation probability, and critical infrastructure targeting profile warrants treating this as a P0 incident — patch or isolate within 24 hours.
Runbook · Step 1
Immediate response (0-24 h)
- Apply the vendor patch immediately: Cisco has released fixes across all affected release trains — consult the Cisco Security Advisory for CVE-2026-20127 to identify the exact fixed version for your deployment. Affected branches include 20.9.x, 20.11–20.12.x, 20.13–20.15.x, and 20.16–20.18.x across Catalyst SD-WAN Controller (vSmart), SD-WAN Manager (vManage), and SD-WAN Validator (vBond).
- Isolate management-plane access: Place all SD-WAN Controller, Manager, and Validator instances behind a dedicated out-of-band management VLAN firewall immediately; restrict inbound connections to the NETCONF port (TCP 830) and SD-WAN peering ports to explicitly authorised peer IP addresses only.
- Identify internet-exposed instances: Build a complete inventory of all Catalyst SD-WAN Controller/Manager/Validator instances reachable from the internet or untrusted network segments — these are your highest-priority patch targets.
- Preserve and review NETCONF audit logs: Export all NETCONF session logs from the past 30 days into your SIEM; review for unknown source IPs and unexpected configuration changes; archive immutably for forensic purposes.
- Rotate all privileged credentials: Treat all administrative accounts and API tokens on affected systems as potentially compromised; rotate immediately, with particular attention to service accounts used for fabric automation.
- Consider emergency shutdown if patching is delayed: If an internet-facing instance cannot be patched within 4 hours, evaluate taking it offline or disabling the peering service until the patch is applied.
Runbook · Step 2
Mitigation layers
- Network segmentation / ACL: Restrict SD-WAN peering ports and NETCONF (TCP 830) via ACL to explicitly permitted peer addresses; enforce default-deny for all other sources at the perimeter firewall and on the host itself (iptables/nftables).
- Enable IPS signatures: Cisco Talos and third-party IPS vendors will publish signatures for CVE-2026-20127 — update Snort/Suricata rulesets and switch to inline blocking mode. Interim Suricata rule shape:
alert tcp any any -> $SD_WAN_MGMT_HOSTS 830 (msg:"CVE-2026-20127 NETCONF Auth Bypass attempt"; content:"<hello"; pcre:"/peering.*bypass/i"; sid:9262027; rev:1;)— refine once PoC details are published. - Enforce mutual TLS for peering: Configure mTLS for all SD-WAN peering connections where the deployed version supports it; pin certificates to known fabric nodes only.
- Least-privilege NETCONF access: Restrict NETCONF access to dedicated, monitored jump hosts; configure RBAC so that internal high-privilege accounts cannot make configuration changes without a four-eyes approval workflow.
- WAF / reverse proxy in front of SD-WAN Manager: If SD-WAN Manager is exposed over HTTPS, deploy a WAF and block requests with anomalous peering headers or unrecognised User-Agent strings.
- Configuration change baselining: Activate a change-management control: every NETCONF
<edit-config>operation must be validated against a known-good configuration baseline (e.g., via Cisco NSO Compliance Reporting or an external config-diff tool).
Runbook · Step 3
Detection rules
- Unauthorised NETCONF source (network telemetry / Zeek/Suricata): Alert on TCP 830 connections originating from IPs outside the known peer allowlist:
alert tcp !$KNOWN_PEERS any -> $SD_WAN_MGMT 830 (msg:"Unauthorized NETCONF source CVE-2026-20127"; sid:9262028;) - Authentication log anomaly (Syslog / SIEM): Cisco SD-WAN Manager writes auth events to Syslog — Sigma rule shape:
title: CVE-2026-20127 Auth Bypass | logsource: product: cisco_sdwan | detection: keywords: ["peering", "authenticated", "non-root"] condition: all of them | falsepositives: Legitimate peer reconnects - Unexpected NETCONF configuration changes: Alert on
<edit-config>operations triggered by accounts not in the authorised change list; KQL snippet (Microsoft Sentinel):SyslogTable | where ProcessName == "netconfd" | where SyslogMessage contains "edit-config" | where not(SrcIpAddr in (authorized_peers)) - Suspicious process ancestry on controller host (EDR): Alert when
netconfdor vManage processes spawn unexpected child processes (e.g., shell interpreters) — Sysmon Event ID 1 with ParentImage filter targeting SD-WAN binaries. - Auth-failure immediately followed by auth-success correlation: Correlation rule: authentication failure followed within <5 seconds by authentication success from the same source IP with no prior established session — indicative of a bypass mechanism rather than a legitimate retry.
Metrics
Weakness classes (CWE)
CWE-287Class
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
cwe.mitre.org →
Reanalysis & status changes
Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.
- CVE Modified2026-06-16 19:16 UTC· psirt@cisco.com
- Description: A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. → A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
cisco
catalyst_sd-wan_manager20.11 – 20.12.5.3
cisco
catalyst_sd-wan_manager20.13 – 20.15.4.2
cisco
catalyst_sd-wan_manager20.16 – 20.18.2.1
cisco
catalyst_sd-wan_manager20.9.8.2
cisco
catalyst_sd-wan_manager
cisco
sd-wan_vbond_orchestrator20.11 – 20.12.5.3
cisco
sd-wan_vbond_orchestrator20.13 – 20.15.4.2
cisco
sd-wan_vbond_orchestrator20.16 – 20.18.2.1
cisco
sd-wan_vbond_orchestrator20.9.8.2
cisco
sd-wan_vbond_orchestrator
cisco
sd-wan_vsmart_controller20.11 – 20.12.5.3
cisco
sd-wan_vsmart_controller20.13 – 20.15.4.2
cisco
sd-wan_vsmart_controller20.16 – 20.18.2.1
cisco
sd-wan_vsmart_controller20.9.8.2
cisco
sd-wan_vsmart_controller
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.
References & sources
Linked advisories
- sans-newsbites-mail2026-06-04 00:00 UTCCisco SD-WAN Manager Vulnerability is Being Actively Exploited
- sans-newsbites-mail2026-05-13 00:00 UTCCisco Announces Max-Severity SD-WAN Flaw, Record Revenue, and Layoffs
- cisco-psirtCisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
- cisco-psirtCisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability