Cisco SD-WAN CVE-2026-20127 and 20182: patch now

What happened

Cisco Catalyst SD-WAN has three control components: the Controller (formerly vSmart), the Manager (formerly vManage) and the Validator (formerly vBond). In 2026 Cisco disclosed two separate flaws in how they authenticate each other as peers. Both are rated CVSS 10.0 and both were exploited before or soon after disclosure.

CVE-2026-20127, 25 February 2026. The peering authentication “is not working properly.” An unauthenticated attacker can send crafted requests, log in as an internal high-privileged non-root account, and use NETCONF to change the configuration of the whole SD-WAN fabric. It affects all deployment types regardless of configuration, and there is no workaround (Tenable; CVE record). Australia’s ASD-ACSC reported it. Cisco Talos tracks the attacker as UAT-8616, and ASD-ACSC says the compromises go back to 2023 (The Hacker News).

The reported attack chain: the actor got in through the peering flaw, used the built-in update mechanism to downgrade the software, exploited an older bug, CVE-2022-20775, to get root, then restored the original version. It then added a rogue peer to the control plane, created local accounts that mimic real ones, added a root SSH key, changed startup scripts, moved between appliances over NETCONF (port 830) and SSH, and wiped logs and history (The Hacker News).

CISA added CVE-2026-20127 to KEV the same day and issued Emergency Directive 26-03, which ordered federal agencies to inventory SD-WAN systems, patch, and look for compromise (The Hacker News).

Three Manager bugs from the same day were then exploited too. Cisco’s companion advisory covered five Manager flaws. In March Cisco learned that CVE-2026-20122 (arbitrary file overwrite with read-only API credentials) and CVE-2026-20128 (readable credential file for the Data Collection Agent user) were exploited. In April it added CVE-2026-20133 (information disclosure) (Cisco). CISA added all three to KEV on 20 April 2026 (CISA KEV).

CVE-2026-20182, 14 May 2026. A second, different peering bypass, this time “in the control connection handshaking.” It was found after the February fix and reported by Stephen Fewer and Jonah Burgess of Rapid7. Cisco says it became aware of “limited exploitation” in May. There is no workaround (Cisco). CISA added it to KEV on 14 May with a due date of 17 May (CISA KEV).

Am I affected?

Every on-premises Catalyst SD-WAN Controller, Manager and Validator below the fixed releases is affected, “regardless of system configuration.” Cisco fixed its own managed cloud (SD-WAN Cloud, Cisco Managed) in 20.15.506 and says no user action is needed there (Cisco). Check the running release on each component with show version on the CLI, or in the Manager web UI.

Then look for compromise. Cisco’s indicators (Cisco, CVE-2026-20182; Cisco, Manager bugs):

bash

# SSH logins as vmanage-admin from addresses that are not your System IPs
grep 'Accepted publickey for vmanage-admin' /var/log/auth.log

# CVE-2026-20128 and CVE-2026-20122 on the Manager
grep -E 'data-collection-agent/\.dca|/dataservice/smartLicensing/uploadAck|/cmd\.gz/cmd\.jsp' \
  /var/log/nms/containers/service-proxy/serviceproxy-access.log

Validate every control-connection-state-change event, especially those with peer-type:vmanage, against your real peers and their public IPs.
Compare every source IP against the System IPs listed under Devices > System IP in the Manager web UI.
On Controllers and Managers, run show control connections detail and show control connections-history detail. On Validators, run show orchestrator connections detail and show orchestrator connections-history detail. Cisco tells customers to look for peers in state:up with no challenge-ack, and to open a TAC case if they find one (Cisco).
In vmanage-server.log, look for files written with ../ into the WildFly deployments directory, such as cmd.gz.war. Any request to /cmd.gz/cmd.jsp is a webshell indicator (Cisco).
For signs of the downgrade step, CISA points to /var/volatile/log/vdebug, /var/log/tmplog/vdebug and /var/volatile/log/sw_script_synccdb.log (The Hacker News).

What to do now

Preserve evidence first. Run request admin-tech on each control component and keep the logs before upgrading. Cisco says that on a confirmed compromise “applying the software update alone will not resolve the vulnerability,” and TAC remediation is required (Cisco).
Upgrade to the May 2026 fixed releases for CVE-2026-20182: 20.9.9.1; 20.12.5.4, 20.12.6.2 or 20.12.7.1; 20.15.4.4 or 20.15.5.2; 20.18.2.2; 26.1.1.1. Releases 20.10, 20.11, 20.13, 20.14 and 20.16 have no fix in their own train; move to 20.12.7.1, 20.15.5.2 or 20.18.2.2. Anything older than 20.9 must migrate (Cisco). The February releases (20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2, 20.18.2.1) fix CVE-2026-20127 and the Manager bugs, not CVE-2026-20182 (Cisco).
Hunt as described above, including for UAT-8616 persistence: local accounts that imitate real ones, unknown keys in root’s authorized_keys, changed startup scripts, and gaps or purges in /var/log (The Hacker News).
Change the DCA user’s password if the CVE-2026-20128 indicators appear. That bug lets an attacker read the DCA password and use it on other affected systems (CVE record).
Close the exposure. Cisco warns that internet-exposed Controllers and ports are “at risk of exposure to compromise” (The Hacker News). Follow CISA’s ED 26-03 hunt and hardening guidance even if you are not a federal agency (CISA ED 26-03; CISA hunt and hardening guidance).

Why this matters

If you patched in February and stopped, you are still exposed. The second bypass sits in the same peering mechanism and needs newer builds in every release train. The attacker also downgraded and then restored the software to use an old bug, so the version you see today does not prove what ran last month.

Cisco Catalyst SD-WAN authentication bypasses CVE-2026-20127 and CVE-2026-20182, plus three exploited Manager bugs

What happened

Am I affected?

What to do now

Why this matters

Sources

Related advisories