CVE-2026-20127
CRITICAL · 10.0 KEV EPSS 89.3%Confirmed in-the-wild exploitation by UAT-11473, Talos analysis, KeyDrift malware deployment observed.
What: Unauthenticated authentication bypass in Cisco Catalyst SD-WAN Controller and Manager allowing remote attackers to gain high-privileged administrative access and manipulate SD-WAN fabric configuration. CVSS 10.0, EPSS 0.89.
Why it matters: KEV-listed since disclosure date. APT group UAT-11473 actively exploiting in the wild to deploy KeyDrift malware framework; Cisco Talos published detailed technical analysis confirming exploitation. Affects critical infrastructure (K-12 districts, 808 organizations reported targeted via stolen credentials). Infrastructure overlap with Volt Typhoon noted.
Where it's seen: Threat intelligence reporting from Cisco Talos (28 Oct 2026), security research aggregators, multilingual analyst commentary. Chatter focuses on remediation urgency and persistence risks when combined with related Cisco flaws (CVE-2026-20182).
RISK: CRITICAL — Unauthenticated RCE, KEV-listed, active APT exploitation, critical infrastructure targeting.
Description
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected versions
- cisco/catalyst_sd-wan_manager
- < 20.9.8.2
- 20.11 – < 20.12.5.3
- 20.13 – < 20.15.4.2
- 20.16 – < 20.18.2.1
- 20.12.6
- cisco/sd-wan_vsmart_controller
- < 20.9.8.2
- 20.11 – < 20.12.5.3
- 20.13 – < 20.15.4.2
- 20.16 – < 20.18.2.1
- 20.12.6