Back
NCSC Warns of Critical Cisco SD-WAN Exploitation

NCSC Warns of Critical Cisco SD-WAN Exploitation

NEWS Publication date: 2026-02-26

The Dutch Nationaal Cyber Security Centrum (NCSC) has issued a high-priority advisory warning of expected large-scale exploitation of a critical vulnerability in Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager. The vulnerability, tracked as CVE-2026-20127, carries a maximum CVSS score of 10.0 and has reportedly been actively exploited since 2023.

Cisco confirmed that attackers have used the flaw in real-world intrusions. The NCSC expects public proof-of-concept exploit code to emerge soon and urges organizations to install available updates immediately.

 

What the Vulnerability Enables

CVE-2026-20127 is an authentication bypass in the SD-WAN peering mechanism. An unauthenticated remote attacker can send crafted requests to gain administrative privileges on affected systems.

Once administrative access is achieved, attackers have been observed downgrading the software to a vulnerable release and exploiting CVE-2022-20775 to escalate privileges to root. After gaining root access, they restore the original version — but retain full system control.

This technique allows adversaries to manipulate the SD-WAN control and management plane, potentially impacting entire enterprise networks.

 

Real-World Impact

According to Cisco and international cyber agencies, exploitation activity dates back to 2023. The activity cluster tracking this campaign is known as UAT-8616. Multinational organizations have reportedly been targeted.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both CVE-2026-20127 and CVE-2022-20775 to its Known Exploited Vulnerabilities (KEV) catalog and mandated rapid remediation for federal agencies.

The UK’s National Cyber Security Centre (NCSC) warned that systems with internet-exposed management interfaces face the highest risk. Management interfaces should never be publicly accessible.

 

How the Attack Typically Unfolds

In observed intrusions, attackers:

  • Bypass authentication via crafted requests
  • Gain administrative access
  • Downgrade the system to a vulnerable version
  • Escalate privileges to root
  • Restore the original version while maintaining persistence

Post-compromise activity has included creating local user accounts, adding SSH keys for root access, modifying startup scripts, using NETCONF (port 830) to move laterally within the SD-WAN fabric, and clearing logs to remove evidence.

 

Detection Considerations

Organizations should review system logs for anomalies. In particular:

  • Check /var/log/auth.log for unexpected entries such as Accepted publickey for vmanage-admin from unknown IP addresses
  • Review logs related to version downgrade or unexpected reboots
  • Inspect systems for unauthorized SSH keys or newly created privileged accounts

If compromise is suspected, a full integrity review and rebuild may be necessary.

 

Remediation

Cisco has released fixed software versions across affected SD-WAN release trains. Organizations running vulnerable versions should upgrade immediately.

To verify exposure at an inventory level, check whether your environment includes the following CPE identifiers:

cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:catalyst_sd-wan_controller:*:*:*:*:*:*:*:*

If these vendor/product combinations appear in your asset inventory, SBOM, or vulnerability scanner output, confirm the running version against Cisco’s fixed releases. In BaseFortify, you can add the component using vendor cisco and the appropriate product name to automatically verify whether the version is vulnerable to CVE-2026-20127.

Additionally:

  • Remove public exposure of SD-WAN management interfaces
  • Restrict access to trusted IP ranges
  • Review logs for indicators of compromise

Given confirmed in-the-wild exploitation and the expectation of public PoC code, patching should be treated as a top-priority action.

 

How BaseFortify Can Help

BaseFortify helps organizations identify exposed components, match them against actively exploited CVEs, and translate technical vulnerability data into practical mitigation steps.

Learn more at: https://basefortify.eu

 

Resources