This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Cisco Catalyst SD-WAN fixes an actively exploited vulnerability
Cisco fixes a critical and already actively exploited vulnerability in Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager with versions 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2 and 20.18.2.1 [1][2]. Cisco Catalyst SD-WAN Controller systems that are reachable from the internet and have open ports are at risk of compromise. The company recommends auditing the auth.log file, located at /var/log/auth.log, for entries related to the message "Accepted publickey for vmanage-admin" from unknown or unauthorized IP addresses. It further recommends comparing the IP addresses in auth.log with the configured System IPs listed in the Cisco Catalyst SD-WAN Manager web interface (WebUI > Devices > System IP) [1].
Allows an unauthenticated remote attacker to bypass login and gain administrator privileges by sending a specially crafted request to the affected system. The attacker can then log in as an internal high-privileged user (not root), use NETCONF and modify the SD-WAN fabric configuration [1].
The vulnerability is present in product:
- Cisco Catalyst SD-WAN; >=20.9, <20.9.8.2; >=20.11, <20.12.6.1; >=20.12.5, <20.12.5.3; >=20.12.6, <20.12.6.1; >=20.13, <20.15.4.2; >=20.14, <20.15.4.2; >=20.15, <20.15.4.2; >=20.16, <20.18.2.1; >=20.18, <20.18.2.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:X
More information:
- CVE-2026-20127 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 25. 2. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 26. 2. 2026.