# CVE-2026-20127: Critical Cisco Catalyst SD-WAN Authentication Bypass Exploited by UAT-8616 Since 2023 (CVSS 10.0)

> A maximum-severity authentication bypass vulnerability (CVSS 10.0) in Cisco Catalyst SD-WAN Controller and Manager allows unauthenticated remote attackers to bypass peering authentication via crafted NETCONF requests, gaining administrative access. Actively exploited as a zero-day by sophisticated threat actor UAT-8616 since at least 2023, targeting critical infrastructure. CISA issued Emergency Directive ED 26-03 mandating immediate federal remediation.

- **Published:** 2026-03-16T12:00:00Z
- **Last reviewed:** 2026-03-16T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0236
- **ID:** TL-2026-0236
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Actor:** UAT-8616 (China)
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20127, CVE-2022-20775, CVE-2026-20128, CVE-2026-20122, CVE-2026-20129, CVE-2026-20126

## Description

CVE-2026-20127 is a critical improper authentication vulnerability (CWE-287) in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Catalyst SD-WAN Manager (formerly vManage). The flaw resides in the peering authentication mechanism, which fails to properly validate authentication for control plane connections. An unauthenticated remote attacker can exploit this by sending crafted requests to bypass authentication and log in as an internal high-privileged non-root user account (vmanage-admin), gaining NETCONF access to manipulate SD-WAN fabric configuration.
The vulnerability affects all deployment models including on-premises, Cisco Hosted SD-WAN Cloud, Cisco Managed, and FedRAMP environments. Approximately 600 Cisco SD-WAN Manager instances are internet-facing, with nearly 25% also exposing ports 22 (SSH) or 830 (NETCONF).
Cisco Talos Intelligence attributed active exploitation to UAT-8616, a highly sophisticated threat actor whose activity dates back to at least 2023 — three years before public disclosure. The observed attack chain is multi-stage: after initial authentication bypass via CVE-2026-20127, the actor adds a rogue peer to the SD-WAN control plane, deliberately downgrades the system software version to one vulnerable to CVE-2022-20775 (a CLI privilege escalation via path traversal), exploits it to achieve root access, then restores the original software version to complicate detection.
Post-compromise activities include creation and deletion of malicious local user accounts mimicking legitimate ones, injection of unauthorized SSH keys into /home/root/.ssh/authorized_keys and vmanage-admin accounts, modification of /etc/ssh/sshd_config to enable PermitRootLogin, lateral movement via NETCONF (port 830) and SSH across the management and control planes, establishment of rogue peer connections, and systematic evidence destruction through log truncation and history clearing.
A public proof-of-concept exploit published by zerozenxlabs on GitHub demonstrates a four-phase attack chain: (1) unauthenticated retrieval of DCA credentials via the /reports/data/opt/data/containers/config/data-collection-agent/.dca endpoint, (2) authentication bypass using the viptela-reserved-dca system account, (3) path traversal exploitation on /dataservice/smartLicensing/uploadAck to deploy a malicious WAR file containing a JSP webshell (cmd.jsp), and (4) remote code execution through the deployed webshell at /cmd.gz/cmd.jsp.
CISA added CVE-2026-20127 to the Known Exploited Vulnerabilities catalog on February 25, 2026, and issued Emergency Directive ED 26-03 requiring federal agencies to inventory all SD-WAN systems, apply patches, assess compromise, and report remediation within strict deadlines. No workarounds are available — patching is the only mitigation.
Related vulnerabilities disclosed in the same campaign include CVE-2026-20128 (DCA credential file exposure, CVSS 7.5), CVE-2026-20122 (API file overwrite, CVSS 5.4), CVE-2026-20129 (unauthenticated netadmin access, CVSS 9.8), and CVE-2026-20126 (low-privilege escalation to root, CVSS 8.8).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1136 Create Account
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1070 Indicator Removal
- T1548 Abuse Elevation Control Mechanism
- T1552 Unsecured Credentials
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1090 Proxy
- T1498 Network Denial of Service

## Sources

- [Cisco Security Advisory: cisco-sa-sdwan-rpa-EHchtZk](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)
- [NVD - CVE-2026-20127](https://nvd.nist.gov/vuln/detail/CVE-2026-20127)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127)
- [Cisco Talos: Active exploitation of Cisco Catalyst SD-WAN by UAT-8616](https://blog.talosintelligence.com/uat-8616-sd-wan/)
- [The Hacker News: Cisco SD-WAN Zero-Day Exploited Since 2023](https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html)
- [Rapid7: Critical Cisco Catalyst Vulnerability Exploited in the Wild](https://www.rapid7.com/blog/post/etr-critical-cisco-catalyst-vulnerability-exploited-in-the-wild-cve-2026-20127/)
- [Tenable: CVE-2026-20127 Zero-Day Auth Bypass Exploited](https://www.tenable.com/blog/cve-2026-20127-cisco-catalyst-sd-wan-controllermanager-zero-day-authentication-bypass)
- [Censys: Cisco Catalyst SD-WAN Authentication Bypass Advisory](https://censys.com/advisory/cve-2026-20127/)
- [Intel 471: CVE-2026-20127 Analysis](https://www.intel471.com/blog/cve-2026-20127-critical-cisco-sd-wan-vulnerability-exploited-in-wild)
- [Greenbone: Emergency Patch CVE-2026-20127](https://www.greenbone.net/en/blog/emergency-patch-cve-2026-20127-in-cisco-catalyst-sd-wan-actively-exploited-against-critical-infrastructure/)
- [Arctic Wolf: CVE-2026-20127 Advisory](https://arcticwolf.com/resources/blog-uk/cve-2026-20127-cisco-catalyst-sd-wan-controller-authentication-bypass-vulnerability/)
- [zerozenxlabs PoC Exploit: CVE-2026-20127 Cisco SD-WAN Preauth RCE](https://github.com/zerozenxlabs/CVE-2026-20127---Cisco-SD-WAN-Preauth-RCE)
- [Sophos: Cisco SD-WAN Vulnerabilities in Active Exploitation](https://www.sophos.com/en-us/blog/cisco-sd-wan-vulnerabilities-cve-2026-20127-cve-2022-20775-in-active-exploitation)
- [SecurityWeek: Cisco Patches SD-WAN Zero-Day Exploited by Highly Sophisticated Hackers](https://www.securityweek.com/cisco-patches-catalyst-sd-wan-zero-day-exploited-by-highly-sophisticated-hackers/)
- [eSentire: CVE-2026-20127 Security Advisory](https://www.esentire.com/security-advisories/cve-2026-20127-cisco-catalyst-zero-day-vulnerability)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0236