Cisco Catalyst SD-WAN Manager Active Exploitation — Arbitrary File Overwrite and Credential Exposure (CVE-2026-20122, CVE-2026-20128)

Cisco Catalyst SD-WAN Manager Active Exploitation (TL-2026-0185), also tracked as cisco-sa-sdwan-authbp-qwCX8D4v, is a critical-severity software vulnerability scored CVSS 7.5, first published 2026-03-06. It has no confirmed attribution, affects Cisco Catalyst SD-WAN Manager (vManage), references 2 CVEs (CVE-2026-20122, CVE-2026-20128), maps to 17 MITRE ATT&CK techniques (T1005, T1021, T1059), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-0185

Threat ID
TL-2026-0185
Also known as
cisco-sa-sdwan-authbp-qwCX8D4v
Severity
CRITICAL
CVSS
7.5 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Status
MONITORING
Category
VULNERABILITY
First published
2026-03-06
Last reviewed
2026-03-06
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, telecommunications, financial, healthcare, defense, critical-infrastructure, service-providers, enterprise
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
16

Malware and tooling in Cisco Catalyst SD-WAN Manager Active Exploitation

Malware and tooling: Snort SID 65938, Snort SID 65958

Two actively exploited vulnerabilities in Cisco Catalyst SD-WAN Manager (formerly Viptela vManage) are being chained by threat actors to deploy web shells on SD-WAN management appliances globally. CVE-2026-20122 (CVSS 5.4) is an arbitrary file overwrite via the management API exploitable with read-only credentials, while CVE-2026-20128 (CVSS 7.5) exposes Data Collection Agent credentials enabling privilege escalation. Exploitation peaked on March 4, 2026, with CISA issuing Emergency Directive ED 26-03.

How Cisco Catalyst SD-WAN Manager Active Exploitation works

Two critical vulnerabilities in Cisco Catalyst SD-WAN Manager are under active exploitation as of early March 2026, part of a broader campaign targeting Cisco SD-WAN infrastructure that has been ongoing since at least 2023.

CVE-2026-20122 (CVSS 5.4, CWE-648) is an arbitrary file overwrite vulnerability in the Cisco Catalyst SD-WAN Manager API. The root cause is twofold: (1) API endpoints validate authentication but fail to enforce write-permission checks, allowing read-only users to execute file write operations, and (2) user-controlled file destination paths lack adequate sanitization, enabling directory traversal attacks. An authenticated remote attacker with only read-only API credentials can overwrite arbitrary files on the local filesystem, gaining vmanage user privileges. The attack surface is the HTTPS management interface on ports 443/8443. This vulnerability is frequently chained with authentication bypass flaws to achieve unauthenticated exploitation.

CVE-2026-20128 (CVSS 7.5, CWE-257) is an information disclosure and privilege escalation vulnerability in the Data Collection Agent (DCA) feature. An unprotected credential file containing the DCA user password is accessible to any user with valid vManage filesystem access. An authenticated local attacker can read this file and use the extracted credentials to gain DCA user privileges, potentially enabling lateral movement across the SD-WAN management infrastructure. Versions 20.18 and later are not affected by this specific CVE.

These vulnerabilities exist alongside CVE-2026-20127 (CVSS 10.0), a critical authentication bypass in the SD-WAN Controller that has been exploited by sophisticated threat actor UAT-8616 since 2023 to establish persistent footholds in high-value organizations. The broader campaign involves software version downgrades, exploitation of CVE-2022-20775 for root escalation, and stealth restoration of original firmware.

watchTowr observed exploitation attempts from numerous unique IP addresses with a peak on March 4, 2026. Threat actors are deploying web shells on exposed SD-WAN Manager instances, overwriting files via the API vulnerability to plant persistent backdoors. Attack activity is globally distributed with slightly elevated targeting of U.S.-based infrastructure.

CISA issued Emergency Directive ED 26-03 on February 26, 2026, requiring federal agencies to inventory systems, collect forensic artifacts, apply patches, and hunt for compromise indicators. The Australian ASD-ACSC, Canadian CCCS, and other Five Eyes partners issued a joint advisory. Cisco patched the vulnerabilities on February 25, 2026, but exploitation intensified after patch release due to rapid weaponization.

The affected product — Cisco Catalyst SD-WAN Manager — is a critical network management plane component used by enterprises, service providers, and government agencies to orchestrate and manage SD-WAN overlay networks. Compromise of vManage provides attackers with visibility into and control over the entire SD-WAN fabric, including routing policies, traffic flows, and connected edge devices.

---

**Revalidated on 2026-03-12**

This threat has been significantly escalated since its initial publication. On March 5, 2026, Cisco PSIRT confirmed active in-the-wild exploitation of both CVE-2026-20122 (arbitrary file overwrite via API, CVSS 7.1) and CVE-2026-20128 (DCA credential exposure enabling cross-instance lateral movement, CVSS 5.5). These vulnerabilities are being exploited as part of a broader, highly sophisticated campaign tracked by Cisco Talos as UAT-8616, which has been targeting Cisco SD-WAN infrastructure globally since at least 2023. The campaign initially leveraged CVE-2026-20127 (CVSS 10.0 authentication bypass) for initial access, then chained CVE-2022-20775 for root privilege escalation via software version downgrade — a technique designed to evade forensic detection by reverting to the original version after exploitation. The exploitation of CVE-2026-20122 and CVE-2026-20128 represents a widening of the attack surface, with attackers using arbitrary file overwrites to gain vmanage user privileges and harvesting DCA credential files to move laterally between SD-WAN Manager deployments. A major exploitation spike was observed on March 4, 2026, with web shell deployment confirmed from numerous unique IP addresses across global regions. The government response has been unprecedented: CISA issued Emergency Directive ED 26-03 on February 25, 2026, mandating federal agencies to inventory, patch, and hunt for compromise, with supplemental hunt and hardening guidance released subsequently. A Five Eyes joint advisory (NSA, CISA, FBI, ASD ACSC, CCCS, NCSC-NZ, NCSC-UK) was published alongside a detailed Cisco SD-WAN Threat Hunt Guide. Additional advisories were issued by the Cyber Security Agency of Singapore and NHS England. CVE-2026-20127 and CVE-2022-20775 were added to the CISA KEV catalog on February 25, 2026 with an emergency 24-hour remediation deadline. Patches are available in versions 20.9.8.2, 20.12.5.3, 20.15.4.2, and 20.18.2.1. No workarounds exist — patching is the only remediation. Organizations on versions older than 20.9 must perform a full migration. Recommended hardening includes configuring DTLS encryption, deploying firewalls in front of SD-WAN infrastructure, using SNMPv3, disabling unnecessary HTTP/FTP services, and changing default administrator passwords.

MITRE ATT&CK techniques used in TL-2026-0185

collection

T1005 Data from Local System

lateral-movement

T1021 Remote Services

execution

T1059 Command and Scripting Interpreter

privilege-escalation

T1068 Exploitation for Privilege Escalation

defense-evasion

T1070 Indicator Removal; T1078 Valid Accounts

command-and-control

T1071 Application Layer Protocol

discovery

T1082 System Information Discovery

persistence

T1098 Account Manipulation; T1136 Create Account; T1505 Server Software Component; T1547 Boot or Logon Autostart Execution

initial-access

T1190 Exploit Public-Facing Application

credential-access

T1552 Unsecured Credentials; T1555 Credentials from Password Stores

impact

T1565 Data Manipulation

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Cisco Catalyst SD-WAN Manager Active Exploitation

  • Cisco — Catalyst SD-WAN Manager (vManage)
    Vulnerable versions: < 20.9.8.2; 20.11.x; 20.12.x < 20.12.5.3; 20.13.x; 20.14.x; 20.15.x < 20.15.4.2; 20.16.x; 20.12.6
    Fixed in: 20.9.8.2; 20.12.5.3; 20.12.6.1; 20.15.4.2; 20.18.2.1
  • Cisco — Catalyst SD-WAN Manager — Cloud Hosted
    Vulnerable versions: On-Premises; Cisco Hosted SD-WAN Cloud; Cisco Hosted SD-WAN Cloud — Cisco Managed; Cisco Hosted SD-WAN Cloud — FedRAMP
    Fixed in: Apply vendor patches per deployment model

Remediation for Cisco Catalyst SD-WAN Manager Active Exploitation

Patches

  • Cisco Security Advisory cisco-sa-sdwan-authbp-qwCX8D4v — February 25, 2026
  • Fixed versions: 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2, 20.18.2.1
  • Versions prior to 20.9.1 must migrate to a fixed release branch

Immediate actions

  • Upgrade Cisco Catalyst SD-WAN Manager to fixed versions: 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2, or 20.18.2.1
  • Restrict API and administrative access to trusted networks only
  • Rotate all API credentials and DCA passwords immediately
  • Disable HTTP for web UI administrator portal — use HTTPS only
  • Monitor for suspicious API calls and file modifications on vManage appliances
  • Assume any internet-exposed SD-WAN Manager instance is compromised until verified

Workarounds

  • Restrict management interface access via ACLs to trusted administrative IPs only
  • Disable unnecessary services (HTTP, FTP) on SD-WAN Manager
  • Change all default administrator credentials
  • Position SD-WAN Manager behind firewalls with strict ingress rules on ports 443/8443
  • Disable Data Collection Agent feature if not required (mitigates CVE-2026-20128)

Longer-term hardening

  • Implement network segmentation isolating SD-WAN management plane from user networks
  • Deploy network-based IDS/IPS with Snort signatures 65938 and 65958
  • Enforce multi-factor authentication on all SD-WAN management interfaces
  • Establish continuous monitoring for unauthorized SSH key additions and account creation
  • Implement file integrity monitoring on SD-WAN Manager appliances
  • Migrate versions prior to 20.9.1 to supported fixed releases

CVEs associated with Cisco Catalyst SD-WAN Manager Active Exploitation

CVE-2026-20122, CVE-2026-20128

Weaknesses (CWE) in Cisco Catalyst SD-WAN Manager Active Exploitation

CWE-648, CWE-257

Timeline of Cisco Catalyst SD-WAN Manager Active Exploitation

Showing the 20 most recent tracked events.

  • Australian Cyber Security Centre (ACSC) publishes advisory on exploitation of Cisco SD-WAN appliances covering CVE-2026-20127, CVE-2026-20128, and CVE-2026-20122 [Source: https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/exploitation-of-cisco-sd-wan-appliances]
  • CISA and international partners release guidance for ongoing global exploitation of Cisco SD-WAN systems, urging immediate patching, artifact collection, and compromise assessment [Source: https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-and-partners-release-guidance-ongoing-global-exploitation-cisco-sd-wan-systems]
  • Five Eyes joint cybersecurity advisory released by NSA, CISA, FBI, ASD ACSC, CCCS, NCSC-NZ, and NCSC-UK with accompanying Cisco SD-WAN Threat Hunt Guide for network defenders [Source: https://media.defense.gov/2026/Feb/25/2003880301/-1/-1/0/CSA_Exploitation_of_SD-WAN_Appliances.PDF]
  • CISA issues Emergency Directive ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems, requiring federal agencies to inventory all SD-WAN systems by February 26 and submit detailed remediation actions by March 5 [Source: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems]
  • CISA adds CVE-2026-20127 and CVE-2022-20775 to the Known Exploited Vulnerabilities (KEV) catalog with 24-hour remediation mandate for federal agencies [Source: https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-adds-two-known-exploited-vulnerabilities-catalog]
  • Cisco Talos publishes detailed research on UAT-8616 active exploitation of Cisco Catalyst SD-WAN via CVE-2026-20127, revealing activity dating back to 2023 with web shell deployment and root privilege escalation [Source: https://blog.talosintelligence.com/uat-8616-sd-wan/]
  • NVD publishes CVE-2026-20122 (CVSS 5.4) and CVE-2026-20128 (CVSS 7.5) with full scoring and affected version details
  • CISA, ASD-ACSC (Australia), CCCS (Canada), and Five Eyes partners release joint advisory on global exploitation of Cisco SD-WAN systems
  • Cisco publishes Security Advisory cisco-sa-sdwan-authbp-qwCX8D4v and releases patches for CVE-2026-20122, CVE-2026-20128, and related vulnerabilities
  • CISA issues Emergency Directive ED 26-03 requiring federal agencies to inventory, patch, and hunt for compromise on Cisco SD-WAN systems
  • Active exploitation reports emerge for CVE-2026-20122 and CVE-2026-20128, with threat actors targeting internet-exposed SD-WAN Manager instances
  • Major spike in exploitation activity observed from numerous unique IP addresses across global regions, with web shell deployment confirmed by third-party telemetry; US-based targets see slightly higher activity [Source: https://thehackernews.com/2026/03/cisco-confirms-active-exploitation-of.html]
  • NVD updates CVE-2026-20128 record with additional analysis and exploitation status
  • watchTowr observes peak exploitation activity with numerous unique source IPs deploying web shells on SD-WAN Manager appliances globally, with elevated targeting of U.S. infrastructure
  • Cisco PSIRT updates advisory cisco-sa-sdwan-authbp-qwCX8D4v to explicitly confirm active in-the-wild exploitation of CVE-2026-20122 and CVE-2026-20128 in SD-WAN Manager [Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v]
  • Multiple security outlets (The Hacker News, SecurityWeek, Help Net Security) report on confirmed exploitation with web shell deployment details
  • Cisco PSIRT updates advisory to explicitly confirm active exploitation of CVE-2026-20122 and CVE-2026-20128 in the wild
  • The Register reports on the two additional SD-WAN Manager bugs (CVE-2026-20122, CVE-2026-20128) now under active attack, expanding beyond the original CVE-2026-20127 campaign [Source: https://www.theregister.com/2026/03/06/cisco_sdwan_bugs/]
  • Cisco Talos updates UAT-8616 blog with additional IOCs, updated guidance, recommendations, and revised timelines for the SD-WAN exploitation campaign [Source: https://blog.talosintelligence.com/uat-8616-sd-wan/]
  • As of 2026-05-29, CVE-2026-20122/20128 stay patched (fixed Feb 25, 2026) but remain under widespread in-the-wild exploitation, with Cisco Talos tracking ~10 threat clusters deploying webshells, Sliver and miners Mar-Apr 2026. The UAT-8616 campaign is ongoing and widening to newer CVEs (20133, 20182); CISA re-mandated ED 26-03 remediation (deadline May 17, all five CVEs in KEV), so this stays MONITORING, not resolved.

Sources cited for Cisco Catalyst SD-WAN Manager Active Exploitation

Threats related to Cisco Catalyst SD-WAN Manager Active Exploitation

Detection coverage for TL-2026-0185

As of 2026-03-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0185 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats