Cisco SD-WAN authentication bypass exploited to plant rogue peers in networks

Cisco on Feb. 25, 2026, disclosed a maximum-severity authentication bypass in its Catalyst SD-WAN Controller and Manager that attackers had already used to break into networks. The Canadian Centre for Cyber Security issued alert AL26-004 the same day, saying it was aware of incidents involving the flaw, tracked as CVE-2026-20127.

Software-defined WAN controllers decide how traffic moves between an organization's offices, data centres and cloud services. An attacker with administrative control over them can watch, reroute or disrupt that traffic and stay hidden for long periods.

What happened

According to Cisco's advisory, the peering authentication mechanism in the affected systems does not work properly. An unauthenticated, remote attacker can send crafted requests to bypass authentication and gain administrative privileges. Cisco scored it 10.0, the highest possible CVSS rating.

The Cyber Centre said reports showed malicious rogue peers had been added to victims' SD-WAN configurations, enabling administrative access, persistence and long-term access. Cisco Talos attributed the activity to a cluster it tracks as UAT-8616. The Australian Signals Directorate's cyber centre led a hunt guide for defenders.

CISA added CVE-2026-20127 to its Known Exploited Vulnerabilities catalogue on Feb. 25, together with an older Cisco SD-WAN path traversal flaw, CVE-2022-20775.

The Cyber Centre noted that controllers with internet-exposed management or control planes, and open ports, are most at risk. Because the attackers' goal was persistence, organizations that patch without checking for added peers may leave an intruder in place.

Affected versions

All deployment types are affected, including on-premises and Cisco-hosted cloud. Fixed releases include 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2 and 20.18.2.1. Releases earlier than 20.9, and 20.11, 20.13, 20.14 and 20.16, have reached end of maintenance and must move to a fixed branch.

What to do

• Collect virtual snapshots and logs from SD-WAN components before patching, to preserve evidence.
• Upgrade to a fixed release.
• Hunt for compromise using the joint hunt guide, looking especially for unexpected peers.
• Apply Cisco's SD-WAN hardening guidance: keep control components behind a firewall, isolate management interfaces and forward logs to a remote syslog server.
• Keep session timeouts as short as practical and use pairwise keying for control and data plane security, as the hardening guide advises.

Organizations that find signs of compromise can report them to the Cyber Centre through My Cyber Portal.