{
  "cisaActionDue": "2026-02-27",
  "cisaExploitAdd": "2026-02-25",
  "cisaRequiredAction": "Please adhere to CISA\u2019s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA\u2019s Emergency Directive 26-03 (URL listed below in Notes) and CISA\u2019s \u201cHunt \u0026 Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.",
  "cisaVulnerabilityName": "Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.\r\n\r\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root\u0026nbsp;user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.\u0026nbsp;"
    }
  ],
  "id": "CVE-2026-20127",
  "lastModified": "2026-02-25T20:27:13.997",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-25T17:25:29.477",
  "references": [
    {
      "source": "psirt@cisco.com",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "summary": "Cisco would like to thank Australian Signals Directorate\u2019s Australian Cyber Security Centre for reporting this vulnerability."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.\r\n\r\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\n",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "This vulnerability affects Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager, regardless of device configuration.\r\n\r\nThis vulnerability affects the following deployment types:\r\n\r\nOn-Prem Deployment\r\nCisco Hosted SD-WAN Cloud\r\nCisco Hosted SD-WAN Cloud - Cisco Managed\r\nCisco Hosted SD-WAN Cloud - FedRAMP Environment\r\n\r\nFor information about which Cisco software releases are vulnerable, see the Fixed Software [\"#fs\"] section of this advisory.",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by these vulnerabilities.",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "Important: To achieve simplification and consistency, the Cisco SD-WAN solution has been rebranded as Cisco Catalyst SD-WAN. In addition, from Cisco IOS XE SD-WAN Release 17.12.1a and Cisco Catalyst SD-WAN Release 20.12.1, the following component changes apply:\r\n\r\nCisco SD-WAN Controllers are now Cisco Catalyst SD-WAN Control Components\r\nCisco SD-WAN vAnalytics is now Cisco Catalyst SD-WAN Analytics\r\nCisco SD-WAN vBond is now Cisco Catalyst SD-WAN Validator\r\nCisco SD-WAN vManage is now Cisco Catalyst SD-WAN Manager\r\nCisco SD-WAN vSmart is now Cisco Catalyst SD-WAN Controller\r\n\r\nFor a comprehensive list of all the component brand name changes, see the latest Release Notes. During the transition to the new names, some inconsistencies might be present in the documentation set because of a phased approach to the user interface updates of the software product.",
        "title": "Details"
      },
      {
        "category": "general",
        "text": "Cisco Catalyst SD-WAN Controller systems that are exposed to the internet and that have ports exposed to the internet are at risk of exposure to compromise.\r\n\r\nCustomers are encouraged to audit the auth.log file, located at /var/log/auth.log, for entries that are related to Accepted publickey for vmanage-admin from unknown or unauthorized IP addresses, as shown in the following example:\r\n\r\n\r\n2026-02-10T22:51:36+00:00 vm \u003cauth.info\u003e sshd[804]: Accepted publickey for vmanage-admin from \u003cSYSTEM IP ADDRESS\u003e port [REDACTED PORT] ssh2: RSA SHA256:[REDACTED KEY]\r\n\r\nCustomers must check the IP address in the auth.log log file against the configured System IPs that are listed in the Cisco Catalyst SD-WAN Manager web UI in the WebUI \u003e Devices \u003e System IP column.\r\n\r\nFor help determining if a Cisco Catalyst SD-WAN Controller or Cisco Catalyst SD-WAN Manager has been compromised, customers should open a case with the Cisco Technical Assistance Center (TAC). Before opening a new TAC case, customers are encouraged to issue the request admin-tech command from each of the control components in the SD-WAN deployment so that the admin-tech file can be provided to the Cisco TAC for review.\r\n\r\nPeering Event Validation Guidance\r\n\r\nAll control connection peering events identified in Cisco Catalyst SD-WAN logs require manual validation to confirm their legitimacy, with a specific focus placed on vmanage peering types. Threat actors who compromise SD-WAN infrastructure often establish unauthorized peer connections that may appear superficially normal but occur at unexpected times, originate from unrecognized IP addresses, or involve device types inconsistent with the environment\u0027s architecture. A comprehensive review process is essential to distinguish between legitimate network operations and potential indicators of compromise.\r\n\r\nValidation Checklist\r\n\r\nVerify the timestamp of each peering event against known maintenance windows, scheduled configuration changes, and normal operational hours for your environment.\r\nConfirm the public IP address corresponds to infrastructure owned or operated by your organization or authorized partners by cross-referencing against asset inventories and authorized IP ranges.\r\nValidate that the peer system IP matches documented device assignments within your SD-WAN topology.\r\nReview the peer type (vmanage, vsmart, vedge, vbond) to ensure it aligns with expected device roles in your deployment.\r\nCorrelate multiple events from the same source IP or system IP to identify patterns of reconnaissance or persistent access attempts.\r\nCross-reference event timing with authentication logs, change management records, and user activity to establish whether the connection was initiated by authorized personnel.\r\n\r\nExample Log Entry\r\n\r\n\r\nJul 26 22:03:33 vSmart-01 VDAEMON_0[2571]: %Viptela-vSmart-VDAEMON_0-5-NTCE-1000001: control-connection-state-change new-state:up peer-type:vmanagepeer-system-ip:1.1.1.10 public-ip:192.168.3.20 public-port:12345 domain-id:1 site-id:1005\r\n\r\nIn the identified example, the peer-system-ip should be validated as matching the expected IP address schema in-use, the timestamp should be validated as matching any events that might cause a peering event to occur and the public-ip should be validated as being an expected source for a peering event.",
        "title": "Indicators of Compromise"
      },
      {
        "category": "general",
        "text": "There are no workarounds that address this vulnerability. However, as a mitigation customers may use the following guidance to temporarily mitigate the impact of this vulnerability while they are planning to upgrade to a first fixed release.\r\n        Action Owner  On-Prem Deployment          Customer  Follow the guidelines in the Firewall Ports for Cisco Catalyst SD-WAN Deployments [\"https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/cisco-sd-wan-overlay-network-bringup.html#c_Firewall_Ports_for_Viptela_Deployments_8690.xml\"] section of the Cisco Catalyst SD-WAN Getting Started Guide.\r\n   Customers who host their own Cisco Catalyst SD-WAN deployment in their own data centers must secure intra-controller connectivity. Cisco recommends adding the access control lists (ACLs), security group rules, and/or firewall rules to restrict the traffic to port 22 and port 830 to allow only known controller IPs and other known IPs.      Action Owner  Cisco Hosted SD-WAN Cloud      Customer  These guardrails are in place for Cisco Hosted SD-WAN Cloud.      Action Owner  Cisco Hosted SD-WAN Cloud - FedRAMP Environment      Customer  These guardrails are in place for Cisco Hosted SD-WAN Cloud - FedRAMP Environment.      Action Owner  Cisco Hosted SD-WAN Cloud - Cisco Managed      Customer and Cisco  These guardrails are in place for Cisco Hosted SD-WAN Cloud - Cisco Managed.\r\nWhile this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate these vulnerabilities and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.\r\n      Fixed Releases\r\nIn the following table, the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability. Customers are advised to upgrade to an appropriate fixed software release [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"] as indicated in this section.\r\n        Cisco Catalyst SD-WAN Release  First Fixed Release          Earlier than 20.91  Migrate to a fixed release.      20.9  20.9.8.2 (Estimated release February 27, 2026)      20.111  20.12.6.1      20.12.5\r\n20.12.6  20.12.5.3\r\n20.12.6.1      20.131  20.15.4.2      20.141  20.15.4.2      20.15  20.15.4.2      20.161  20.18.2.1      20.18  20.18.2.1\r\n1. These releases have reached End of Software Maintenance [\"https://www.cisco.com/c/en/us/products/routers/sd-wan/eos-eol-notice-listing.html\"]. Cisco strongly encourages customers to upgrade to a supported release [\"https://www.cisco.com/c/en/us/td/docs/routers/sdwan/release/notes/compatibility-and-server-recommendations.html\"].\r\nThe Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.\r\n\r\nAdditional Information\r\n\r\nTo check component and software release compatibility, see the SD-WAN Controller Component Compatibility Matrix [\"https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/catalyst_sdwan_compatibility_matrix/index.html\"].\r\nFor help planning an upgrade, Cisco Catalyst SD-WAN Upgrade Matrix [\"https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/catalyst-sdwan-upgrade-matrix/index.html\"].",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "Cisco recommends upgrading the affected systems to a fixed software release.\r\n\r\nGeneral Recommendations for Hardening\r\n\r\nPrevent access from unsecured networks, such as the internet, to the system. If internet access to the system is required, restrict system access to only known, trusted hosts on ports/protocols that are included in the user guides.\r\nProtect Cisco Catalyst SD-WAN Control Components behind a filtering device such as a firewall, and filter traffic to and from the systems while allowing only known, trusted hosts to send traffic to the systems. Using a two-layer firewall can provide flexibility in network planning so that end users do not connect directly to the outer DMZ. See the Deployment sections of the User Guides for Cisco Catalyst SD-WAN software [\"https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html#DeploymentPlanning\"].\r\nRegularly monitor web log traffic for any unexpected traffic to and from systems. Logging should be sent to an external server, if possible, and kept for a long enough duration so that post-event investigations can be performed with sufficient log data.\r\nDisable HTTP for the Cisco Catalyst SD-WAN Manager web UI administrator portal.\r\nDisable any network services that are not required, including HTTP and FTP. For more information about specific service functionality, see the Cisco Catalyst SD-WAN user guides.\r\nUpgrade the system to the latest version of Cisco Catalyst SD-WAN Software.\r\nChange the default administrator password to a more secure variant. Restrict access to the administrator account by creating user accounts based on necessary access requirements. In addition, create operator accounts for all administrators.\r\nUse SSL/TLS, obtain an SSL certificate from a certificate authority (CA), or create a self-signed certificate.\r\n\r\nFor more information, review the Cisco Catalyst SD-WAN Hardening Guide [\"https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide\"].",
        "title": "Recommendations"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco PSIRT is aware of limited exploitation of this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "Cisco would like to thank Australian Signals Directorate\u2019s Australian Cyber Security Centre for reporting this vulnerability.",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT\r\n\r\nThe Cisco Support and Downloads [\"https://www.cisco.com/c/en/us/support/index.html\"] page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid.\r\n\r\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]. Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories [\"https://www.cisco.com/go/psirt\"] for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"] or their contracted maintenance providers.\r\n    LEGAL DISCLAIMER DETAILS\r\n\r\nCISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nCopies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the Cisco Security Advisories [\"https://www.cisco.com/go/psirt\"] page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the Cisco Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"] for more information.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@cisco.com",
      "issuing_authority": "Cisco PSIRT",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "Firewall Ports for Cisco Catalyst SD-WAN Deployments",
        "url": "https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/cisco-sd-wan-overlay-network-bringup.html#c_Firewall_Ports_for_Viptela_Deployments_8690.xml"
      },
      {
        "category": "external",
        "summary": "fixed software release",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "End of Software Maintenance",
        "url": "https://www.cisco.com/c/en/us/products/routers/sd-wan/eos-eol-notice-listing.html"
      },
      {
        "category": "external",
        "summary": "supported release",
        "url": "https://www.cisco.com/c/en/us/td/docs/routers/sdwan/release/notes/compatibility-and-server-recommendations.html"
      },
      {
        "category": "external",
        "summary": "SD-WAN Controller Component Compatibility Matrix",
        "url": "https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/catalyst_sdwan_compatibility_matrix/index.html"
      },
      {
        "category": "external",
        "summary": "Cisco Catalyst SD-WAN Upgrade Matrix",
        "url": "https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/catalyst-sdwan-upgrade-matrix/index.html"
      },
      {
        "category": "external",
        "summary": "Deployment sections of the User Guides for Cisco Catalyst SD-WAN software",
        "url": "https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html#DeploymentPlanning"
      },
      {
        "category": "external",
        "summary": "Cisco Catalyst SD-WAN Hardening Guide",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "Cisco Support and Downloads",
        "url": "https://www.cisco.com/c/en/us/support/index.html"
      },
      {
        "category": "external",
        "summary": "Cisco Technical Assistance Center (TAC)",
        "url": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"
      },
      {
        "category": "external",
        "summary": "the advisories",
        "url": "https://www.cisco.com/go/psirt"
      }
    ],
    "title": "Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability",
    "tracking": {
      "current_release_date": "2026-02-25T16:00:00+00:00",
      "generator": {
        "date": "2026-02-25T16:00:23+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-sdwan-rpa-EHchtZk",
      "initial_release_date": "2026-02-25T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-02-25T15:59:40+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Cisco Catalyst SD-WAN Manager",
            "product": {
              "name": "Cisco Catalyst SD-WAN Manager ",
              "product_id": "CSAFPID-271450"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-20127",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCws52722"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-271450"
        ]
      },
      "release_date": "2026-02-25T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-271450"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-271450"
          ]
        }
      ],
      "title": "Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Catalyst SD-WAN versions 20.12.6.x ant\u00e9rieures \u00e0 20.12.6.1",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN versions ant\u00e9rieures \u00e0 20.9.8.2",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN versions 20.15.x ant\u00e9rieures \u00e0 20.15.4.2",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN versions 20.12.5.x ant\u00e9rieures \u00e0 20.12.5.3",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN versions 20.18.x ant\u00e9rieures \u00e0 20.18.2.1",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "Cisco indique que la publication de la version corrective 20.9.8.2 pour Catalyst SD-WAN est pr\u00e9vue le 27 f\u00e9vrier 2026. Les versions 20.11.x, 20.13.x, 20.14.x et 20.16.x sont affect\u00e9es par la vuln\u00e9rabilit\u00e9 mais ne b\u00e9n\u00e9ficieront pas de correctifs de s\u00e9curit\u00e9 car elles ont atteint la fin de p\u00e9riode de maintenance. Le CERT-FR recommande de migrer vers une version maintenue et avec les derniers correctifs de s\u00e9curit\u00e9.\n\nL\u0027\u00e9diteur pr\u00e9cise aussi que la solution Cisco SD-WAN a \u00e9t\u00e9 renomm\u00e9e Cisco Catalyst SD-WAN. L\u0027avis \u00e9diteur indique \u00e9galement d\u0027autres changements de noms pour les composants de cette solution. ",
  "closed_at": null,
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-20127",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20127"
    }
  ],
  "initial_release_date": "2026-02-25T00:00:00",
  "last_revision_date": "2026-02-25T00:00:00",
  "links": [
    {
      "title": "Avis CERTFR-2026-AVI-0210",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0210/"
    }
  ],
  "reference": "CERTFR-2026-ALE-002",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-02-25T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Cisco Catalyst SD-WAN. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.\n\nCisco indique que la vuln\u00e9rabilit\u00e9 CVE-2026-20127 est activement exploit\u00e9e.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Cisco Catalyst SD-WAN",
  "vendor_advisories": [
    {
      "published_at": "2026-02-25",
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Cisco heeft meerdere kwetsbaarheden verholpen in de Cisco Catalyst SD-WAN Manager.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden bevinden zich in de peering authenticatiemechanismen van de Cisco Catalyst SD-WAN Controller en Manager producten. Deze kwetsbaarheden stellen een niet-geauthenticeerde externe aanvaller in staat om het authenticatieproces te omzeilen, waardoor administratieve privileges op de getroffen systemen kunnen worden verkregen. Daarnaast kunnen aanvallers root-level privileges verkrijgen, wat kan leiden tot ongeautoriseerde toegang tot gevoelige informatie en de mogelijkheid om willekeurige bestanden te overschrijven, wat kan resulteren in verdere exploitatie of systeeminstabiliteit.\n\nDe meest ernstige kwetsbaarheid, met kenmerk CVE-2026-20127, kan door een ongeauthenticeerde kwaadwillende worden misbruikt om op afstand willekeurige code uit te voeren met hoge administratieve rechten. Cisco geeft aan dat actief misbruik van deze kwetsbaarheid bekend is.\n\nNa misbruik van deze kwetsbaarheid zou de kwaadwillende de kwetsbaarheid met kenmerk CVE-2022-20775 gebruiken om de rechten te escaleren tot root. Dit doet de actor door het systeem te downgraden naar een versie waarin CVE-2022-20775 niet verholpen is, de rechten middels deze kwetsbaarheid te verhogen naar root en vervolgens het systeem weer terug te zetten in de oorspronkelijke versie.\n\nHet NCSC verwacht op korte termijn een publieke PoC en grootschalige pogingen tot misbruik van CVE-2026-20127. Het NCSC adviseert met klem de update zo spoedig mogelijk te installeren.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. In een blog geeft Talos informatie over het bekende misbruik en is er een validatie checklist  beschikbaar gesteld met uitleg hoe deze kan worden toegepast. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      },
      {
        "category": "general",
        "text": "Storing Passwords in a Recoverable Format",
        "title": "CWE-257"
      },
      {
        "category": "general",
        "text": "Improper Authentication",
        "title": "CWE-287"
      },
      {
        "category": "general",
        "text": "Incorrect Use of Privileged APIs",
        "title": "CWE-648"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://blog.talosintelligence.com/uat-8616-sd-wan"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Cisco Catalyst SD-WAN Manager",
    "tracking": {
      "current_release_date": "2026-02-25T17:11:09.013125Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0071",
      "initial_release_date": "2026-02-25T17:11:09.013125Z",
      "revision_history": [
        {
          "date": "2026-02-25T17:11:09.013125Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Catalyst SD-WAN Manager"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Cisco Catalyst SD-WAN"
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-20122",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager could enable attackers to gain root privileges, access sensitive data, and overwrite arbitrary files, posing significant security risks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20122 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20122.json"
        }
      ],
      "title": "CVE-2026-20122"
    },
    {
      "cve": "CVE-2026-20126",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager could enable attackers to gain root privileges, access sensitive data, and overwrite arbitrary files, posing significant security risks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20126 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20126.json"
        }
      ],
      "title": "CVE-2026-20126"
    },
    {
      "cve": "CVE-2026-20127",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "description",
          "text": "A vulnerability in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller and Manager allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20127 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20127.json"
        }
      ],
      "title": "CVE-2026-20127"
    },
    {
      "cve": "CVE-2026-20128",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager could enable attackers to gain root privileges, access sensitive data, and overwrite arbitrary files, posing significant security risks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20128 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20128.json"
        }
      ],
      "title": "CVE-2026-20128"
    },
    {
      "cve": "CVE-2026-20129",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager could enable attackers to gain root privileges, access sensitive data, and overwrite arbitrary files, posing significant security risks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20129 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20129.json"
        }
      ],
      "title": "CVE-2026-20129"
    },
    {
      "cve": "CVE-2026-20133",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager could enable attackers to gain root privileges, access sensitive data, and overwrite arbitrary files, posing significant security risks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20133 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20133.json"
        }
      ],
      "title": "CVE-2026-20133"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions ant\u00e9rieures \u00e0 20.9.8.2",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.12.6.x ant\u00e9rieures \u00e0 20.12.6.1",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.15.x ant\u00e9rieures \u00e0 20.15.4.2",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.18.x ant\u00e9rieures \u00e0 20.18.2.1",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.12.5.x ant\u00e9rieures \u00e0 20.12.5.3",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "Cisco indique que la publication de la version corrective 20.9.8.2 pour Catalyst SD-WAN et Catalyst SD-WAN Manager est pr\u00e9vue le 27 f\u00e9vrier 2026. Les versions 20.11.x, 20.13.x, 20.14.x et 20.16.x sont affect\u00e9es par les vuln\u00e9rabilit\u00e9s mais ne b\u00e9n\u00e9ficieront pas de correctifs de s\u00e9curit\u00e9 car elles ont atteint la fin de p\u00e9riode de maintenance. Le CERT-FR recommande de migrer vers une version maintenue et avec les derniers correctifs de s\u00e9curit\u00e9.\n\nL\u0027\u00e9diteur pr\u00e9cise aussi que la solution Cisco SD-WAN a \u00e9t\u00e9 renomm\u00e9e Cisco Catalyst SD-WAN. Les avis \u00e9diteurs indiquent \u00e9galement d\u0027autres changements de noms pour les composants de cette solution. ",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-20126",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20126"
    },
    {
      "name": "CVE-2026-20128",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20128"
    },
    {
      "name": "CVE-2026-20122",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20122"
    },
    {
      "name": "CVE-2026-20129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20129"
    },
    {
      "name": "CVE-2026-20127",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20127"
    },
    {
      "name": "CVE-2026-20133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20133"
    }
  ],
  "initial_release_date": "2026-02-25T00:00:00",
  "last_revision_date": "2026-02-25T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0210",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-02-25T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Cisco Catalyst SD-WAN. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n\nCisco indique que la vuln\u00e9rabilit\u00e9 CVE-2026-20127 est activement exploit\u00e9e.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Cisco Catalyst SD-WAN",
  "vendor_advisories": [
    {
      "published_at": "2026-02-25",
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sdwan-authbp-qwCX8D4v",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"
    },
    {
      "published_at": "2026-02-25",
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sdwan-rpa-EHchtZk",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-20127"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-25T17:25:29Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.\n\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root\u0026nbsp;user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.\u0026nbsp;",
  "id": "GHSA-p4cq-46q3-jr7w",
  "modified": "2026-02-25T18:31:38Z",
  "published": "2026-02-25T18:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20127"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}