{"id":"cisco-sdwan-authentication-bypass-feb-2026","category":"patch","status":"live","title":"Cisco Catalyst SD-WAN authentication bypass CVE-2026-20127 exploited; fixes available","tldr":"Attackers used a login bypass in Cisco Catalyst SD-WAN business-network systems, later linked to KeyDrift malware designed to collect encryption keys. Fixes are available. Ask IT to update all affected components and investigate any earlier compromise.","summary":"CVE-2026-20127 lets a remote attacker gain administrative access without valid credentials and change the configuration of a Cisco Catalyst SD-WAN network. It affects Controller, Manager and Validator components in on-premises and Cisco-hosted deployments, regardless of configuration. Cisco disclosed it on 25 February, and Talos traced associated malicious activity back to at least 2023. Fixes are now available for every supported release line; obsolete releases need migration. In October, Talos described another exploitation cluster deploying KeyDrift, malware designed to maintain access and collect network encryption keys. Its report did not establish whether keys were transmitted. As of 3 November, the software flaw is patched, but an update alone does not establish that an already compromised system is clean. Cisco recommends compromise assessment and support-led remediation.","action":"If your business or family office uses Cisco Catalyst SD-WAN, ask its IT provider to check Controller, Manager and Validator against the fixed versions below and arrange a Cisco TAC compromise assessment. Have the provider preserve diagnostic evidence before remediation and investigate earlier intrusions even if updates have already been installed.","product":"Cisco Catalyst SD-WAN Controller, Manager and Validator","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-20127"],"tags":["cisco","sd-wan","authentication-bypass","zero-day","actively-exploited","keydrift"],"affected":["Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage) and Validator (formerly vBond), regardless of configuration, in on-premises and Cisco-hosted deployments","20.9, 20.12, 20.15 and 20.18 releases without the applicable fix","Releases earlier than 20.9, and release lines 20.11, 20.13, 20.14 and 20.16: migrate as directed by Cisco"],"fixed":["20.9: 20.9.8.2","20.11: migrate to 20.12.6.1","20.12: 20.12.5.3 or 20.12.6.1, according to maintenance branch","20.13, 20.14 and 20.15: 20.15.4.2","20.16 and 20.18: 20.18.2.1","Cisco-hosted CDCS clusters only: 20.15.405 is also fixed"],"matches":[],"sources":[{"kind":"advisory","title":"Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk","by":"Cisco","date":"2026-10-28"},{"kind":"advisory","title":"Remediate Catalyst SD-WAN Security Advisory - February 2026","url":"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/225525-internal-remediate-catalyst-sd-wan.html","by":"Cisco","date":"2026-03-19"},{"kind":"research","title":"Active exploitation of Cisco Catalyst SD-WAN by UAT-8616","url":"https://blog.talosintelligence.com/uat-8616-sd-wan/","by":"Cisco Talos","date":"2026-02-25"},{"kind":"research","title":"Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN","url":"https://blog.talosintelligence.com/uat-11473-keydrift/","by":"Cisco Talos","date":"2026-10-28"},{"kind":"news","title":"Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited Since 2023 for Admin Access","url":"https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html","by":"The Hacker News","date":"2026-02-26"},{"kind":"news","title":"Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys","url":"https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html","by":"The Hacker News","date":"2026-10-29"},{"kind":"advisory","title":"Exploitation of Zero-Day Vulnerability in Cisco Catalyst SD-WAN","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4748","by":"NHS England","date":"2026-03-09"}],"started":"2026-02-25","closed":null,"created":"2026-11-03T22:30:00.465Z","updated":"2026-11-03T22:30:00.465Z","cve_notes":[{"cve":"CVE-2026-20127","name":"Authentication bypass in Cisco SD-WAN control components","what":"Faulty peering authentication in Cisco Catalyst SD-WAN Controller, Manager and Validator lets a remote attacker gain administrative access without credentials and manipulate network configuration.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-10-28","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"Cisco Talos published historical findings on UAT-11473 exploiting the flaw to install KeyDrift, malware designed to collect network encryption keys and maintain access. Targets included space and satellite services, defence and aerospace technology, and policy research; the report did not establish when these attacks occurred or whether keys were transmitted.","url":"https://blog.talosintelligence.com/uat-11473-keydrift/","by":"Cisco Talos","patch":null},{"at":"2026-06-16","added":"2026-11-03T22:23:31.291Z","kind":"vendor-revised","text":"Cisco added Catalyst SD-WAN Validator, formerly vBond, to the affected products alongside Controller and Manager.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk","by":"Cisco","patch":null},{"at":"2026-03-19","added":"2026-11-03T22:23:31.291Z","kind":"vendor-revised","text":"Cisco expanded its compromise-checking guidance. It warned that upgrading prevents further exploitation but may leave an earlier compromise in place, and recommended rescanning diagnostic bundles using its updated checks.","url":"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/225525-internal-remediate-catalyst-sd-wan.html","by":"Cisco","patch":null},{"at":"2026-03-03","added":"2026-11-03T22:23:31.291Z","kind":"vendor-revised","text":"Cisco revised its mitigation guidance. It recommends restricting access to ports 22 and 830 to known systems while arranging an upgrade; these restrictions do not replace the fix.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk","by":"Cisco","patch":null},{"at":"2026-02-27","added":"2026-11-03T22:23:31.291Z","kind":"new-fix","text":"Cisco made 20.9.8.2 available, completing fixes for the supported release lines. Older releases require migration to a fixed release.","url":"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/225525-internal-remediate-catalyst-sd-wan.html","by":"Cisco","patch":"patched"},{"at":"2026-02-25T16:00Z","added":"2026-11-03T22:23:31.291Z","kind":"disclosed","text":"Cisco disclosed CVE-2026-20127 and confirmed exploitation. Updates were available for some releases, but the 20.9 fix was not yet available.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk","by":"Cisco","patch":"partial"},{"at":"2026-02-25","added":"2026-11-03T22:23:31.291Z","kind":"cisa-added","text":"CISA added CVE-2026-20127 to its Known Exploited Vulnerabilities catalogue and issued an emergency directive requiring federal civilian agencies to inventory, investigate and remediate affected systems.","url":"https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html","by":"The Hacker News","patch":null},{"at":"2026-02-25","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"Cisco Talos reported that the exploitation campaign it tracks as UAT-8616 included malicious activity dating back to at least 2023.","url":"https://blog.talosintelligence.com/uat-8616-sd-wan/","by":"Cisco Talos","patch":null}],"url":"https://hard.fyi/live/cisco-sdwan-authentication-bypass-feb-2026/","json":"https://hard.fyi/api/live?id=cisco-sdwan-authentication-bypass-feb-2026"}