Type Vulnerability
A newly identified APT group, UAT-11473, was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controller and Manager. Known-exploited catalogue reports exploitation in the wild.
Cisco · Auth bypass
Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
CVE-2026-20127
What this means
This is rated critical severity (10 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Cisco Catalyst Sd Wan Manager, Cisco Sd Wan Vbond Orchestrator and Cisco Sd Wan Vsmart Controller are in your estate, and treat that as the priority.
Full vendor description
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
Scoring and exploitation
10.0/ 10
CVSS 3.1 base scoreCritical
Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability, and it can reach beyond the vulnerable system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeChangedS:C
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
- Elevated attack likelihood (~87.6% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Cisco Catalyst SD-WAN Controller and Manager
Weaknesses
CWE-287
Affected products ()
- Cisco Catalyst Sd Wan Manager
- Cisco Sd Wan Vbond Orchestrator
- Cisco Sd Wan Vsmart Controller
Show the raw CPE strings (6)
- cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:20.12.6:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.12.6:*:*:*:*:*:*:*
References
2 links from the CVE record, grouped by site; the vendor's advisory comes first.
sec.cloudapps.cisco.com1 linkVendor advisory
- cisco-sa-sdwan-rpa-EHchtZk (opens in a new tab)Vendor Advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource