Authentication Bypass Vulnerability Affecting Cisco Catalyst SD-WAN Controller and Manager
A critical vulnerability affecting Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager could allow an attacker to bypass the authentication mechanism and gain administrative privileges on affected systems.
Description
Technical context and vulnerability details
Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager are solutions that provide centralized management of network policies and configurations in SD-WAN architectures. These solutions are affected by a critical vulnerability labeled CVE-2026-20127, which results from an insufficiency in the identity verification system between equipment. Exploitation of this vulnerability would allow an unauthenticated attacker to send specially crafted authentication requests to bypass authentication and gain privileged access to network administration and management interfaces. It is classified critical with a severity score of 10.0 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Bypassing the authentication mechanism;
- Unauthorized access;
- Data privacy breach;
- Compromise of system integrity;
Affected systems
Products, components and targeted versions
- Cisco Catalyst SD-WAN Controller and Manager versions earlier than 20.9.8.2;
- Cisco Catalyst SD-WAN Controller and Manager version 20.12.6 and versions 20.11 through 20.12.5.3;
- Cisco Catalyst SD-WAN Controller and Manager versions 20.13 through 20.15.4.2;
- Cisco Catalyst SD-WAN Controller and Manager versions 20.16 through 20.18.2.1;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Cisco Catalyst SD-WAN Controller and Manager to one of the versions below or later:;
- 20.9.8.2;
- 20.12.6.1;
- 20.12.5.3;
- 20.15.4.2;
- 20.18.2.1;
- restrict access to management interfaces to only trusted IP addresses;
Sources & External Links
Vendor security advisories and documentation
- https://nvd.nist.gov/vuln/detail/CVE-2026-20127
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://thehackernews.com/2026/02/critical-cisco-sd-wan-auth-bypass.html
- https://thehackernews.com/2026/02/critical-cisco-sd-wan-zero-day-cve-2026-20127.html
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.