NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksUpdated

Cisco Catalyst SD-WAN authentication bypass CVE-2026-20127 exploited; fixes available

Attackers used a login bypass in Cisco Catalyst SD-WAN business-network systems, later linked to KeyDrift malware designed to collect encryption keys. Fixes are available. Ask IT to update all affected components and investigate any earlier compromise.

What to do

If your business or family office uses Cisco Catalyst SD-WAN, ask its IT provider to check Controller, Manager and Validator against the fixed versions below and arrange a Cisco TAC compromise assessment. Have the provider preserve diagnostic evidence before remediation and investigate earlier intrusions even if updates have already been installed.

What’s happening

CVE-2026-20127 lets a remote attacker gain administrative access without valid credentials and change the configuration of a Cisco Catalyst SD-WAN network. It affects Controller, Manager and Validator components in on-premises and Cisco-hosted deployments, regardless of configuration. Cisco disclosed it on 25 February, and Talos traced associated malicious activity back to at least 2023. Fixes are now available for every supported release line; obsolete releases need migration. In October, Talos described another exploitation cluster deploying KeyDrift, malware designed to maintain access and collect network encryption keys. Its report did not establish whether keys were transmitted. As of 3 November, the software flaw is patched, but an update alone does not establish that an already compromised system is clean. Cisco recommends compromise assessment and support-led remediation.

What
Flaw
Affects
Cisco Catalyst SD-WAN Controller, Manager and Validator
Affected
Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage) and Validator (formerly vBond), regardless of configuration, in on-premises and Cisco-hosted deployments
20.9, 20.12, 20.15 and 20.18 releases without the applicable fix
Releases earlier than 20.9, and release lines 20.11, 20.13, 20.14 and 20.16: migrate as directed by Cisco
Fixed in
20.9: 20.9.8.2
20.11: migrate to 20.12.6.1
20.12: 20.12.5.3 or 20.12.6.1, according to maintenance branch
20.13, 20.14 and 20.15: 20.15.4.2
20.16 and 20.18: 20.18.2.1
Cisco-hosted CDCS clusters only: 20.15.405 is also fixed
CVE
CVE-2026-20127
Since
25 Feb 2026

Timeline

  1. Update

    Cisco Talos published historical findings on UAT-11473 exploiting the flaw to install KeyDrift, malware designed to collect network encryption keys and maintain access. Targets included space and satellite services, defence and aerospace technology, and policy research; the report did not establish when these attacks occurred or whether keys were transmitted.

  2. Vendor revised

    Cisco added Catalyst SD-WAN Validator, formerly vBond, to the affected products alongside Controller and Manager.

  3. Vendor revised

    Cisco expanded its compromise-checking guidance. It warned that upgrading prevents further exploitation but may leave an earlier compromise in place, and recommended rescanning diagnostic bundles using its updated checks.

  4. Vendor revised

    Cisco revised its mitigation guidance. It recommends restricting access to ports 22 and 830 to known systems while arranging an upgrade; these restrictions do not replace the fix.

  5. New fixFixed

    Cisco made 20.9.8.2 available, completing fixes for the supported release lines. Older releases require migration to a fixed release.

  6. Made publicPartly fixed

    Cisco disclosed CVE-2026-20127 and confirmed exploitation. Updates were available for some releases, but the 20.9 fix was not yet available.

  7. CISA added

    CISA added CVE-2026-20127 to its Known Exploited Vulnerabilities catalogue and issued an emergency directive requiring federal civilian agencies to inventory, investigate and remediate affected systems.

  8. Update

    Cisco Talos reported that the exploitation campaign it tracks as UAT-8616 included malicious activity dating back to at least 2023.

Sources

  1. Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCisco · 28 Oct 2026
  2. Remediate Catalyst SD-WAN Security Advisory - February 2026Cisco · 19 Mar 2026
  3. Active exploitation of Cisco Catalyst SD-WAN by UAT-8616Cisco Talos · 25 Feb 2026
  4. Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WANCisco Talos · 28 Oct 2026
  5. Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited Since 2023 for Admin AccessThe Hacker News · 26 Feb 2026
  6. Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption KeysThe Hacker News · 29 Oct 2026
  7. Exploitation of Zero-Day Vulnerability in Cisco Catalyst SD-WANNHS England · 9 Mar 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from February 2026 · JSON · RSS