CVSS 10.0: Cisco SD-WAN Zero-Day Has Been Owned Since 2023 — And You Have 24 Hours to Patch

THE STORY

On February 25, 2026, Cisco disclosed CVE-2026-20127 — a critical authentication bypass vulnerability carrying the maximum CVSS score of 10.0. The flaw affects Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage) across on-prem and cloud deployments, regardless of device configuration.

The vulnerability exists because the peering authentication mechanism in affected systems does not function correctly. An unauthenticated, remote attacker can send crafted requests to bypass authentication entirely, logging in as a high-privileged internal user account. From there, they gain NETCONF access — meaning they can manipulate the network configuration of your entire SD-WAN fabric.

Cisco's Talos threat intelligence group is tracking the exploitation under the designation UAT-8616, which it assesses with high confidence as a "highly sophisticated cyber threat actor." The critical finding: this exploitation has been active since at least 2023. Three years of silent access to enterprise network control planes.

The attack was reported by the Australian Signals Directorate's Australian Cyber Security Centre (ASD-ACSC), and within hours, CISA issued Emergency Directive 26-03 — requiring all Federal Civilian Executive Branch agencies to inventory SD-WAN systems, collect forensic artifacts, apply patches, and investigate for compromise, all by 5:00 PM ET on February 27. CISA stated the exploitation poses "an imminent threat to federal networks."

A joint hunt guide from CISA and the UK's National Cyber Security Centre warned that attackers are targeting Cisco SD-WAN deployments globally, adding rogue peers and achieving root access to maintain persistent control over compromised network infrastructure.

THE ADVERSARY PERSPECTIVE

This Is Network Control Plane Takeover — Not Just Another Vuln

From an offensive security standpoint, CVE-2026-20127 is as bad as it gets. This isn't a vulnerability in a web application or an endpoint agent. This is an authentication bypass on the control plane of your wide-area network. The SD-WAN controller dictates how traffic flows between every branch office, data center, and cloud environment in your organization. Owning the controller means owning the network.

What makes UAT-8616's tradecraft particularly alarming is the chaining technique. After gaining admin access through CVE-2026-20127, the attacker doesn't just sit on the compromised account. They downgrade the SD-WAN controller's firmware to a version vulnerable to CVE-2022-20775 — a path traversal privilege escalation flaw — exploit it to gain root access, then upgrade the firmware back to the original version. The result: full root persistence with no visible evidence in the current running software version.

This is the kind of operational security you see from nation-state operators, not commodity attackers. The downgrade-exploit-restore pattern is designed to defeat exactly the forensic checks most organizations would perform — verifying the running version and assuming it's clean.

Post-compromise, the attacker creates local user accounts, plants unauthorized SSH keys, enables root login, and uses NETCONF and SSH for lateral movement across the SD-WAN fabric. They can monitor traffic, manipulate routing policies, and pivot into internal infrastructure — all from a position that most security monitoring tools never inspect.

There's another dimension organizations are missing: the control peering mechanism itself was broken. This means every organization running affected versions has been trusting an authentication system that fundamentally didn't work. This isn't a misconfiguration issue — it's a design-level failure in how Cisco SD-WAN validates peer connections.

DEFENSIVE TAKEAWAYS