CISA Adds Cisco SD-WAN Flaws to Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency added two vulnerabilities in Cisco's Catalyst SD-WAN software to its Known Exploited Vulnerabilities catalog on Wednesday, confirming active exploitation of a critical authentication bypass flaw since at least 2023 by a highly sophisticated threat actor.

The primary vulnerability, tracked as CVE-2026-20127 and assigned a maximum severity score of 10.0 on the CVSS scale, affects the Cisco Catalyst SD-WAN Controller and Manager. It stems from a flaw in the peering authentication mechanism that allows remote, unauthenticated attackers to send crafted requests and gain high-privileged access without proper credentials. Once inside, attackers can log in as an internal non-root user, access the NETCONF interface, and manipulate network configurations across the SD-WAN fabric. The issue impacts all deployments of the software, regardless of configuration.

Cisco's threat intelligence team, Talos, linked the exploitation to a cluster of activity designated UAT-8616, describing the actor as advanced and persistent. Investigations revealed that the group has targeted network edge devices to establish long-term footholds in...