Strix
26.1K

CVE-2026-20127

CRITICALCVSS 10/10Actively ExploitedEPSS 57.79%

Last modified

CVE-2026-20127 is a critical-severity vulnerability rated 10/10 on the CVSS scale. A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. CISA has confirmed active exploitation in the wild. EPSS estimates a 57.79% chance of exploitation in the next 30 days.

Description

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. 

Metrics

CVSS 3.1
10/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Probability
57.79%

99.0th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .

Weakness Enumeration

Affected Software

VendorProductVersions
CiscoCatalyst Sd-Wan Manager< 20.9.8.2
CiscoCatalyst Sd-Wan Manager>= 20.11, < 20.12.5.3
CiscoCatalyst Sd-Wan Manager>= 20.13, < 20.15.4.2
CiscoCatalyst Sd-Wan Manager>= 20.16, < 20.18.2.1
CiscoCatalyst Sd-Wan Manager20.12.6
CiscoSd-Wan Vbond Orchestrator< 20.9.8.2
CiscoSd-Wan Vbond Orchestrator>= 20.11, < 20.12.5.3
CiscoSd-Wan Vbond Orchestrator>= 20.13, < 20.15.4.2
CiscoSd-Wan Vbond Orchestrator>= 20.16, < 20.18.2.1
CiscoSd-Wan Vbond Orchestrator20.12.6
CiscoSd-Wan Vsmart Controller< 20.9.8.2
CiscoSd-Wan Vsmart Controller>= 20.11, < 20.12.5.3
CiscoSd-Wan Vsmart Controller>= 20.13, < 20.15.4.2
CiscoSd-Wan Vsmart Controller>= 20.16, < 20.18.2.1
CiscoSd-Wan Vsmart Controller20.12.6

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2026-20127?
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root&nbsp;user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.&nbsp;
How severe is CVE-2026-20127?
CVE-2026-20127 has a CVSS score of 10/10 (CRITICAL severity). The EPSS model estimates a 57.79% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2026-20127?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-20127?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST