NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Cisco SD-WAN privilege-escalation flaw CVE-2022-20775 used in attacks

Attackers used an old Cisco SD-WAN flaw to gain full control after obtaining access. It affects business network equipment. Ask your network provider to install a current fixed release and investigate for existing compromise.

What to do

If your business or family office uses Cisco SD-WAN, ask its network provider to install a current Cisco-recommended fixed release and check for unauthorised accounts, keys and connections using Cisco's investigation guidance. Historical fixes for this flaw start at 20.6.3, 20.7.2 and 20.8.1; older affected branches require migration.

What’s happening

CVE-2022-20775 is a flaw in Cisco SD-WAN's command-line controls that lets an authenticated local attacker run commands with full system privileges. It affects business network infrastructure. Cisco published fixes in September 2022, but acknowledged attempted exploitation in February 2026. CISA listed it as exploited on 25 February, while Cisco Talos linked its use to UAT-8616, a group targeting high-value organisations, including critical infrastructure. Talos reported that a separate authentication bypass provided initial access. Fixes remain available; older affected release branches require migration. As at 3 November 2026, Cisco's advisory has no revision after 25 February. Patching must be accompanied by checks for existing compromise.

What
Flaw
Affects
Cisco SD-WAN network controllers, management software and vEdge routers
Affected
Cisco SD-WAN vBond Orchestrator Software, vEdge Cloud Routers, vEdge Routers, vManage Software and vSmart Controller Software running affected Cisco SD-WAN releases.
Affected release branches: 18.4 and earlier, 19.2, 20.3, 20.6 before 20.6.3, 20.7 before 20.7.2, and 20.8 before 20.8.1. Cisco lists 20.9 as unaffected and excludes Cisco IOS XE SD-WAN Software.
Fixed in
Cisco SD-WAN Software 20.6.3
Cisco SD-WAN Software 20.7.2
Cisco SD-WAN Software 20.8.1
CVE
CVE-2022-20775
Since
25 Feb 2026
Closed
25 Feb 2026

Timeline

  1. Vendor revised

    Cisco updated its advisory to acknowledge attempted exploitation during February 2026 and renewed its recommendation to upgrade.

  2. Update

    Cisco Talos reported that UAT-8616 used the flaw to obtain root access after a separate SD-WAN authentication bypass. The wider campaign's activity dated back to at least 2023; Talos did not date this flaw's first use separately.

  3. CISA added

    CISA added CVE-2022-20775 to its Known Exploited Vulnerabilities catalogue, with a 27 February deadline for US federal civilian agencies to act.

  4. Vendor revised

    Cisco corrected the first fixed 20.6 release from 20.6.4 to 20.6.3.

  5. Made publicFixed

    Cisco disclosed CVE-2022-20775 and published fixed-release information. The flaw lets an authenticated local attacker gain root privileges.

Sources

  1. Cisco SD-WAN Software Privilege Escalation VulnerabilitiesCisco · 25 Feb 2026
  2. Active exploitation of Cisco Catalyst SD-WAN by UAT-8616Cisco Talos · 25 Feb 2026
  3. CVE-2022-20775 DetailNIST · 17 June 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from February 2026 · JSON · RSS