# Cisco Catalyst SD-WAN Zero-Day (CVE-2026-20127) — UAT-8616 Active Exploitation Since 2023, Authentication Bypass to Admin, Critical Infrastructure Targeting

> CVE-2026-20127 is a critical (CVSS 10.0) unauthenticated remote authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller (formerly vSmart) and SD-WAN Manager (formerly vManage). Actively exploited since at least 2023 by UAT-8616, a highly sophisticated threat actor tracked by Cisco Talos. Exploitation grants administrative privileges via crafted peering requests, enabling NETCONF access to manipulate the entire SD-WAN fabric configuration. Post-exploitation chains with CVE-2022-20775 (path traversal) for root escalation via software version downgrade. Joint advisories from ACSC (Australia), NCSC (UK), CCCS (Canada), and CISA Emergency Directive 26-03.

- **Published:** 2026-02-26T12:00:00Z
- **Last reviewed:** 2026-02-26T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0145
- **ID:** TL-2026-0145
- **Severity:** CRITICAL (CVSS 10)
- **Category:** ZERO_DAY
- **Status:** PATCHED
- **Actor:** UAT-8616 (China)
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20127, CVE-2022-20775

## Description

CVE-2026-20127 is a critical authentication bypass vulnerability in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager. The vulnerability exists because the peering authentication mechanism is not working properly, allowing an unauthenticated remote attacker to send crafted requests to bypass authentication and obtain administrative privileges on the affected system.

Successful exploitation allows the attacker to log in as an internal, high-privileged, non-root user account. Using this account, the attacker gains access to NETCONF, which enables manipulation of network configuration across the entire SD-WAN fabric — a catastrophic compromise for organizations relying on SD-WAN for branch connectivity and network segmentation.

Cisco Talos tracks the exploitation activity as UAT-8616, assessed with high confidence to be a highly sophisticated cyber threat actor. Investigation revealed that malicious activity dates back at least three years to 2023, making this a long-running zero-day exploitation campaign. Investigation by intelligence partners (ACSC Australia) identified that UAT-8616 escalated to root via a version downgrade attack: the actor downgrades the SD-WAN software to a vulnerable version, exploits CVE-2022-20775 (CWE-25, path traversal via crafted username with '/../../' strings) for root privilege escalation, then restores the original software version to cover tracks.

The vulnerability affects all deployment types: On-Premises, Cisco Hosted SD-WAN Cloud, Cisco Hosted SD-WAN Cloud - Cisco Managed, and Cisco Hosted SD-WAN Cloud - FedRAMP Environment. Systems with internet-exposed management or control planes and exposed ports are at highest risk.

Post-compromise indicators include: unauthorized control connection peering events (especially vManage peer types from unknown IPs), creation and deletion of malicious user accounts with absent bash_history and cli-history, interactive root sessions with unauthorized SSH keys in /home/root/.ssh/authorized_keys (with PermitRootLogin set to yes), unauthorized SSH keys for vmanage-admin account, abnormally small or zero-byte log files (syslog, wtmp, lastlog, cli-history, bash_history), evidence of log clearing/truncation, unexplained peer additions/drops, and unauthorized version downgrade/upgrade cycles with system reboots.

The CISA added both CVE-2026-20127 and CVE-2022-20775 to the Known Exploited Vulnerabilities catalog on 2026-02-25, with a remediation due date of 2026-02-27 (2-day deadline reflecting emergency severity). CISA issued Emergency Directive 26-03. Multi-nation response: Cisco Talos (US), ACSC (Australia), NCSC (UK), CCCS (Canada) all issued coordinated advisories and hunt guides.

UAT-8616's targeting of SD-WAN controllers represents a critical escalation in the network edge device targeting trend. Compromising the SD-WAN controller gives an attacker the ability to reconfigure the entire overlay network, redirect traffic, intercept communications, and establish persistent access across all branch sites — far more impactful than compromising a single endpoint. Cisco released Snort rules 65938 and 65958 for detection.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1098.004 SSH Authorized Keys
- T1136.001 Local Account
- T1078.001 Default Accounts
- T1068 Exploitation for Privilege Escalation
- T1685.006 Clear Linux or Mac System Logs
- T1070.003 Clear Command History
- T1689 Downgrade Attack
- T1552.004 Private Keys
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1021.004 SSH
- T1039 Data from Network Shared Drive
- T1040 Network Sniffing
- T1090.002 External Proxy
- T1219 Remote Access Tools
- T1498 Network Denial of Service
- T1557 Adversary-in-the-Middle

## Sources

- [Cisco Talos: Active exploitation of Cisco Catalyst SD-WAN by UAT-8616](https://blog.talosintelligence.com/uat-8616-sd-wan/)
- [Cisco Security Advisory: CVE-2026-20127 — Authentication Bypass Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)
- [ACSC: Cisco Catalyst SD-WAN Hunt Guide](https://www.cyber.gov.au/sites/default/files/2026-02/ACSC-led%20Cisco%20SD-WAN%20Hunt%20Guide.pdf)
- [NCSC (UK): Exploitation of Cisco Catalyst SD-WANs](https://www.ncsc.gov.uk/news/exploitation-cisco-catalyst-sd-wans)
- [CCCS (Canada): AL26-004 — Critical vulnerability affecting Cisco Catalyst SD-WAN](https://www.cyber.gc.ca/en/alerts-advisories/al26-004-critical-vulnerability-affecting-cisco-catalyst-sd-wan-cve-2026-20127)
- [NVD: CVE-2026-20127 — CVSS 10.0 Authentication Bypass](https://nvd.nist.gov/vuln/detail/CVE-2026-20127)
- [NVD: CVE-2022-20775 — SD-WAN CLI Path Traversal (chained for root)](https://nvd.nist.gov/vuln/detail/CVE-2022-20775)
- [CISA KEV: CVE-2026-20127 — Emergency Directive 26-03](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127)
- [Cisco Catalyst SD-WAN Hardening Guide](https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0145