Cisco Catalyst SD-WAN Manager und SD-WAN Controller: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 6

• Critical 10.0
  CVE-2026-20127 Exploited Public exploit EPSS 88%

  Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

  A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remo…

  Cisco Cisco Catalyst SD-WAN Manager Network devices
  Feb 25, 2026

  KEV Feb 25, 2026
• High 7.5
  CVE-2026-20128 Exploited

  Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability

  A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for t…

  Cisco Cisco Catalyst SD-WAN Manager Network devices
  Feb 25, 2026

  KEV Apr 20, 2026
• Medium 6.5
  CVE-2026-20133 Exploited EPSS 35%

  A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive inf…

  Cisco Cisco Catalyst SD-WAN Manager Network devices
  Feb 25, 2026

  KEV Apr 20, 2026
• Medium 5.4
  CVE-2026-20122 Exploited EPSS 26%

  Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability

  A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access …

  Cisco Cisco Catalyst SD-WAN Manager Network devices
  Feb 25, 2026

  KEV Apr 20, 2026
• Critical 9.8
  CVE-2026-20129

  Cisco Catayst SD-WAN Authentication Bypass Vulnerability

  A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected system as a user who has the netadmin role. The vulnerability is due to improper authentication …

  Cisco Cisco Catalyst SD-WAN Manager Network devices
  Feb 25, 2026
• High 8.8
  CVE-2026-20126

  Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability

  A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system. This vulnerability is due to an insufficient user authentication mechanism in the RES…

  Cisco Cisco Catalyst SD-WAN Manager Network devices
  Feb 25, 2026

Revision history

1. 2026-04-20 #4

   Aktive Ausnutzung gemeldet

2. 2026-03-05 #3

   PoC aufgenommen

3. 2026-03-04 #2

   Exploit aufgenommen CVE-2026-20128 und CVE-2026-20122

4. 2026-02-25 #1

   Initiale Fassung

References

• Cisco Security Advisory cisco-sa-sdwan-authbp-qwCX8D4v vom 2026-02-25
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v
• Cisco Security Advisory cisco-sa-sdwan-rpa-EHchtZk vom 2026-02-25
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
• CISA KEV: CVE-2026-20127 Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability vom 2026-02-25
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Cisco Talos Blog: Active exploitation of Cisco Catalyst SD-WAN by UAT-8616 vom 2026-02-25
  https://blog.talosintelligence.com/uat-8616-sd-wan/
• Australian Signals Directorate - Cisco SD-WAN Threat Hunt Guide
  https://www.cyber.gov.au/sites/default/files/2026-02/ACSC-led%20Cisco%20SD-WAN%20Hunt%20Guide.pdf
• PoC CVE-2026-20127
  https://github.com/zerozenxlabs/CVE-2026-20127---Cisco-SD-WAN-Preauth-RCE