Skip to content
  • There are no suggestions because the search field is empty.

2026-10-29: Cybercriminals exploit critical Cisco Catalyst SD-WAN vulnerability to gain admin access without a password

Scan for this vulnerability

To find this vulnerability, follow these instructions and scan for this HID:

  • HID-2-1-5416214

Please note!
The test needs an authenticated scan (SSH credentials) to read the Catalyst SD-WAN Manager version. 

Cisco Catalyst SD-WAN, the system that many organizations use to run their wide area networks, contains an authentication bypass vulnerability that lets cybercriminals skip the login and gain admin access. They do this with specially crafted requests, and Cisco has confirmed that CVE-2026-20127, which carries a 10.0 out of 10 (Critical) CVSS score, is already actively exploited.

Read Cisco's advisory here (external link).

How the vulnerability works

The vulnerability sits in the peering authentication, which SD-WAN components use to prove to each other that they’re trusted. Cisco says this check “is not working properly.” Cybercriminals fool it with specially crafted requests.

Why this is dangerous

Cisco says a successful attack logs cybercriminals in as an internal, high-privileged account. From there they can use NETCONF, the management interface that controls device configuration, to change the network configuration of the entire SD-WAN fabric.

Cisco is aware of exploitation in the wild. CISA issued Emergency Directive 26-03, ordering federal agencies to secure their Cisco SD-WAN systems. CISA added CVE-2026-20127 to its KEV Catalog on February 25. It gave federal agencies until February 27 to act.

See CISA’s KEV Catalog entry for CVE-2026-20127 (external link).

Lumen’s Black Lotus Labs says Volt Typhoon, a China-linked state-sponsored group, was exploiting CVE-2026-20127 as a zero-day by late 2025. Exploitation continued well after Cisco disclosed the vulnerability in February. The attacks ran through Silent Train, a rotating chain of hijacked home-office routers, IoT devices, and enterprise systems that hides where an attack really comes from. Cisco Talos tracks the exploitation it observed as UAT-8616 and dates it to at least 2023.

Read Lumen’s Silent Train research (external link).

Read Cisco Talos’ analysis of UAT-8616 (external link).

Affected software

According to Cisco, these components are affected regardless of device configuration:

  • Catalyst SD-WAN Manager (formerly vManage)
  • Catalyst SD-WAN Controller (formerly vSmart)
  • Catalyst SD-WAN Validator (formerly vBond)

        On-premises deployments are affected, and so are Cisco-hosted SD-WAN Cloud deployments, including Cisco-managed and FedRAMP environments.

        Mitigation & next steps

        Cisco urges customers to upgrade to:

        • 20.9.8.2
        • 20.12.5.3
        • 20.12.6.1
        • 20.15.4.2
        • 20.18.2.1, or later

                  Cisco says no workarounds exist, so upgrading is the only fix. Customers on older release lines should migrate to a fixed release. After upgrading, follow CISA’s hunt and hardening guidance for Cisco SD-WAN to check for signs of an earlier breach.

                  Holm Security’s response

                        Holm Security has released a test to scan for this vulnerability:

                        • HID-2-1-5416214 - Cisco Catalyst SD-WAN Manager Authentication Bypass Vulnerability (cisco-sa-sdwan-rpa-EHchtZk) (February 2026)

                        Please note!
                        The test needs an authenticated scan (SSH credentials) to read the Catalyst SD-WAN Manager version.