# CVE-2026-20127 Cisco Catalyst SD-WAN Zero-Day — UAT-8616 Authentication Bypass Active Exploitation

> Critical authentication bypass zero-day (CVE-2026-20127, CVSS 9.8) in Cisco Catalyst SD-WAN Controller (vSmart) and SD-WAN Manager (vManage) under active exploitation by sophisticated threat actor UAT-8616 since at least 2023. Chained with CVE-2022-20775 path traversal for root access via software version downgrade attack. Joint advisories from CISA (Emergency Directive ED 26-03), NCSC UK, and ACSC Australia. Targets critical infrastructure SD-WAN control plane.

- **Published:** 2026-03-02T10:32:00Z
- **Last reviewed:** 2026-03-02T10:32:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0166
- **ID:** TL-2026-0166
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** SUPERSEDED
- **Actor:** UAT-8616 (China)
- **Detections:** 4 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20127, CVE-2022-20775

## Description

CVE-2026-20127 is a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage). The vulnerability exists because the peering authentication mechanism is not working properly, allowing an unauthenticated remote attacker to send crafted requests and gain administrative privileges as an internal high-privileged non-root user account. Using this access, the attacker can reach NETCONF and manipulate SD-WAN fabric configuration.

Cisco Talos tracks the exploitation activity as UAT-8616, assessed with high confidence to be a highly sophisticated cyber threat actor. Investigation revealed exploitation dating back to at least 2023, making this a multi-year zero-day campaign. Post-exploitation, UAT-8616 adds rogue peer devices that appear as legitimate SD-WAN components, then escalates to root access through a software version downgrade attack chained with CVE-2022-20775 (path traversal for privilege escalation). After achieving root, the actor restores the original software version to evade detection.

The attack chain targets the SD-WAN control plane — the most sensitive component managing connectivity across sites and clouds. UAT-8616 demonstrates sophisticated tradecraft including rogue peering with anomalous 'remote-color' values, creation and deletion of malicious user accounts, SSH key injection for vmanage-admin and root accounts, comprehensive log clearing (syslog, wtmp, lastlog, cli-history, bash_history), and configuration manipulation via NETCONF. International partners (ACSC Australia) observed lateral movement outside the SD-WAN environment.

CISA issued Emergency Directive ED 26-03 on 2026-02-25 requiring federal agencies to inventory, collect forensic artifacts, patch by 5:00 PM ET February 27, and conduct threat hunting following the ACSC-led joint hunt guide. The vulnerability affects all deployment types: on-prem, Cisco Hosted SD-WAN Cloud, Cisco Managed, and FedRAMP environments. No workarounds exist — patching is the only durable fix. Cisco released Snort rules 65938 and 65958 for network detection.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1098.004 SSH Authorized Keys
- T1136.001 Local Account
- T1068 Exploitation for Privilege Escalation
- T1078.001 Default Accounts
- T1685.006 Clear Linux or Mac System Logs
- T1070.003 Clear Command History
- T1601.002 Downgrade System Image
- T1685 Disable or Modify Tools
- T1552.004 Private Keys
- T1021.004 SSH
- T1039 Data from Network Shared Drive
- T1090.003 Multi-hop Proxy
- T1219 Remote Access Tools
- T1498 Network Denial of Service
- T0831 Manipulation of Control
- T1059.004 Unix Shell
- T1046 Network Service Discovery
- T1070.006 Timestomp

## Sources

- [Cisco Talos: Active exploitation of Cisco Catalyst SD-WAN by UAT-8616](https://blog.talosintelligence.com/uat-8616-sd-wan/)
- [Cisco Security Advisory: cisco-sa-sdwan-rpa-EHchtZk](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)
- [CISA Emergency Directive ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems](https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems)
- [CISA Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems](https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems)
- [NCSC UK: Exploitation of Cisco Catalyst SD-WANs](https://www.ncsc.gov.uk/news/exploitation-cisco-catalyst-sd-wans)
- [ACSC Hunt Guide: Cisco SD-WAN Threat Hunt Guide](https://www.cyber.gov.au/sites/default/files/2026-02/ACSC-led%20Cisco%20SD-WAN%20Hunt%20Guide.pdf)
- [SOC Prime: CVE-2026-20127 Cisco SD-WAN Zero-Day Exploited Since 2023](https://socprime.com/blog/cve-2026-20127-vulnerability/)
- [Sophos: Cisco SD-WAN vulnerabilities CVE-2026-20127 and CVE-2022-20775 in active exploitation](https://www.sophos.com/en-us/blog/cisco-sd-wan-vulnerabilities-cve-2026-20127-cve-2022-20775-in-active-exploitation)
- [Cisco Catalyst SD-WAN Hardening Guide](https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide)
- [NCSC CTO Summary: Week ending March 1st — Cisco SD-WAN exploitation highlighted](https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-march-a25)
- [SentinelOne: The Good, the Bad and the Ugly in Cybersecurity — Week 9](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-9-7/)
- [Canadian Centre for Cyber Security: Advisory AL26-004 — Critical Vulnerability Affecting Cisco Catalyst SD-WAN](https://www.cyber.gc.ca/en/alerts-advisories/al26-004-critical-vulnerability-affecting-cisco-catalyst-sd-wan-cve-2026-20127)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0166