Cisco SD-WAN Zero-Day Exploited Since 2023
Executive Summary
In February 2026, Cisco disclosed a critical zero-day vulnerability (CVE-2026-20127) in its Catalyst SD-WAN Controller and Manager, which had been actively exploited since at least 2023. The flaw allowed unauthenticated remote attackers to bypass authentication mechanisms, granting them high-privileged access to manipulate network configurations via the NETCONF protocol. This exploitation enabled the addition of rogue peers and potential disruption of network operations. (thehackernews.com)
The incident underscores the persistent targeting of network infrastructure by sophisticated threat actors, emphasizing the need for organizations to prioritize timely patching and robust security measures to protect critical systems. (thehackernews.com)
Why This Matters Now
The exploitation of CVE-2026-20127 highlights the ongoing risks posed by unpatched vulnerabilities in critical network infrastructure, necessitating immediate action to mitigate potential threats. (thehackernews.com)
Attack Path Analysis
The threat actor exploited CVE-2026-20127 to gain unauthorized access to Cisco Catalyst SD-WAN Controllers, escalating privileges to root by downgrading software versions. They added rogue peers to the SD-WAN control plane, enabling lateral movement and manipulation of network configurations. Command and control were established through NETCONF and SSH, facilitating persistent access. Data exfiltration was achieved by modifying VPN and tunnel settings to intercept or redirect traffic. The impact included unauthorized policy changes and potential disruption of network services.
Kill Chain Progression
Initial Compromise
Description
Exploited CVE-2026-20127 to bypass authentication and gain high-privileged access to Cisco Catalyst SD-WAN Controllers.
Related CVEs
CVE-2026-20127
CVSS 10An authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller allows unauthenticated, remote attackers to obtain administrative privileges by sending crafted requests.
Affected Products:
Cisco Catalyst SD-WAN Controller – 20.9, 20.11, 20.12, 20.13, 20.14, 20.15, 20.16, 20.18
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Techniques identified for SEO/filtering; full STIX/TAXII enrichment to follow.
Valid Accounts
External Remote Services
Abuse Elevation Control Mechanism
Indicator Removal on Host
Remote Services
Application Layer Protocol
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Change Control Processes
Control ID: 6.4.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Incident Handling
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Telecommunications
Critical SD-WAN infrastructure vulnerabilities enable three-year network exploitation, compromising encrypted traffic flows and zero-trust segmentation across telecommunications backbone systems.
Banking/Mortgage
Financial institutions face severe data exfiltration risks through compromised SD-WAN networks, violating PCI compliance requirements and enabling lateral movement attacks.
Health Care / Life Sciences
Healthcare networks exploited via SD-WAN zero-days risk HIPAA violations, patient data exposure, and compromised medical device connectivity through unsecured traffic.
Government Administration
Government SD-WAN infrastructure compromised for three years enables sophisticated threat actors to conduct network reconnaissance and establish persistent command-and-control channels.
Sources
- Cisco SD-WAN Zero-Day Under Exploitation for 3 Yearshttps://www.darkreading.com/vulnerabilities-threats/cisco-sd-wan-zero-day-exploitation-3-yearsVerified
- Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerabilityhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZkVerified
- NVD - CVE-2026-20127https://nvd.nist.gov/vuln/detail/CVE-2026-20127Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have limited the attacker's ability to exploit vulnerabilities and move laterally within the network, thereby reducing the potential impact and blast radius of the breach.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to exploit vulnerabilities in the SD-WAN Controllers would likely be constrained, reducing unauthorized access to critical network infrastructure.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges to root may be limited, reducing the scope of unauthorized control over network devices.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally within the network would likely be constrained, reducing unauthorized access to other network devices.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to maintain persistent access through NETCONF and SSH may be limited, reducing unauthorized control over network configurations.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate data by modifying VPN and tunnel settings would likely be constrained, reducing unauthorized data interception or redirection.
The attacker's ability to implement unauthorized policy changes may be limited, reducing the potential disruption of network services.
Impact at a Glance
Affected Business Functions
- Network Management
- Data Transmission
- Remote Access
Estimated downtime: 3 days
Estimated loss: $500,000
Potential exposure of sensitive network configurations and administrative credentials.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict unauthorized lateral movement within the network.
- • Enforce Egress Security & Policy Enforcement to monitor and control outbound traffic, preventing unauthorized data exfiltration.
- • Utilize Multicloud Visibility & Control to detect and respond to anomalous activities across cloud environments.
- • Deploy Inline IPS (Suricata) to identify and block known exploit patterns and malicious payloads.
- • Regularly update and patch systems to mitigate vulnerabilities like CVE-2026-20127 and CVE-2022-20775.
