CVE-2026-20127

ENISA EUVD: EUVD-2026-8675 ↗
Exploited in the Wild ✓ Confirmed 0-Day
Triaged: March 5, 2026 27 articles Published: 2026-02-25
VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23
44.3%
probability
This CVE has a 44.3% probability of being exploited in the next 30 days.
0% Top 97.6th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)
10
CRITICAL
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

VulnerabilityLookup (CNA)
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. 

Affected Products

Cisco
Cisco Catalyst SD-WAN Manager
20.1.12 19.2.1 18.4.4 18.4.5 20.1.1.1 20.1.1

Attack Intelligence

Signal Intelligence

Confidenceⓘ
92%
EPSS 44.3%
CVSS v3.1 10
Mentions 27
Last Seen May 15, 2026

CNA Information

CNA Assigner
cisco
CNA Title
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Analyst Note

CVE-2026-20127 exhibits strong zero-day indicators: explicitly named as 'zero-day' in authoritative sources (TheHackerNews, Tenable-Research), exploitation documented since 2023 (years before February 2026 publication), and active exploitation in the wild confirmed by multiple trusted security sources including CERT-EU and BleepingComputer. The timing clearly shows exploitation preceded public disclosure.

Triage Info

Decided atMar 05, 2026
Published DateFeb 25, 2026