Loading story…
Researchers warned that defenders may be underestimating the risk from Cisco SD-WAN flaws beyond the widely publicized zero-day CVE-2026-20127, particularly CVE-2026-20133, a high-severity issue tied to inadequate file system access restrictions. VulnCheck reported that public attention and detection efforts have focused too narrowly on CVE-2026-20127, even though proof-of-concept activity attributed to that bug appears to affect other vulnerabilities, including CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122. Defused researchers said their telemetry supports that assessment, indicating that CVE-2026-20127 is generating heavy automated noise while activity involving CVE-2026-20133, if present, is likely quieter and easier to miss.
Broader reporting indicates the SD-WAN issue is part of a larger pattern of active exploitation across Cisco edge infrastructure, with multiple recently disclosed SD-WAN and firewall vulnerabilities already exploited in the wild. CyberScoop reported that five of nine Cisco flaws disclosed across firewalls and SD-WAN systems in recent weeks have seen exploitation, including two SD-WAN zero-days abused for years before discovery and three additional SD-WAN defects later confirmed under attack. The reporting also noted exploitation of a maximum-severity Cisco firewall management flaw by Interlock ransomware, underscoring that attackers are targeting management-plane and control-plane weaknesses in network-edge products that often serve as enterprise trust anchors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
CISA added Cisco Catalyst SD-WAN Manager vulnerability CVE-2026-20133 to its Known Exploited Vulnerabilities catalog after determining there was evidence of active exploitation. The agency ordered Federal Civilian Executive Branch agencies to secure affected systems by 2026-04-24 and follow Emergency Directive 26-03 and Cisco hardening guidance.
CISA added Cisco Catalyst SD-WAN Manager flaws CVE-2026-20128 and CVE-2026-20122 to its Known Exploited Vulnerabilities catalog after Cisco confirmed active exploitation. Federal agencies were given a remediation deadline in late April 2026, expanding U.S. government response beyond CVE-2026-20133 alone.
VulnCheck assessed that the high-severity Cisco Catalyst SD-WAN flaw CVE-2026-20133 may pose a greater immediate risk than the more publicized zero-day CVE-2026-20127. Defused researchers also said vulnerable SD-WAN devices were being targeted through multiple avenues and that CVE-2026-20133 exploitation may be quieter and easier to miss.
VulnCheck reported that a proof-of-concept published by ZeroZenX Labs for CVE-2026-20127 did not actually target that zero-day, but instead affected CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122. The finding suggested defenders may be misjudging which SD-WAN vulnerabilities are most urgent.
Cisco recently disclosed nine vulnerabilities affecting SD-WAN and firewall management products, with five later confirmed as exploited in the wild. The disclosures included the zero-day CVE-2026-20127 and other SD-WAN flaws such as CVE-2026-20133.
Cisco released fixes in late February 2026 for CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133 affecting Catalyst SD-WAN Manager. The vulnerabilities were later cited by CISA as actively exploited or included in its Known Exploited Vulnerabilities catalog.
CISA issued an emergency directive requiring federal executive branch agencies to assess and patch Cisco SD-WAN Manager systems after concerns about active exploitation. The directive elevated the urgency of the Cisco SD-WAN vulnerability situation for U.S. government networks.
Amazon Threat Intelligence said the Interlock ransomware group started exploiting a maximum-severity Cisco firewall management vulnerability before it was publicly disclosed. The exploitation reportedly began on January 26 and targeted firewall management infrastructure.
Two Cisco SD-WAN zero-day vulnerabilities were reportedly exploited in the wild for at least three years before Cisco disclosed them. This indicates long-running attacker access to SD-WAN management or control-plane systems prior to public awareness.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcego.theregister.com
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourcecybersecuritydive.com
Open sourcesdxcentral.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CISA** ordered U.S. federal civilian agencies to urgently remediate a **critical Cisco Catalyst SD-WAN Manager compromise** tied to **CVE-2026-20127**, a `CVSS 10.0` authentication bypass flaw that allows attackers to obtain high-privilege access without valid credentials. Reporting indicates the activity was uncovered by **CISA** and **Cisco Talos**, which attributed exploitation to **UAT-8616** and assessed that the intrusions date back to 2023. Attackers reportedly maintained persistence by downgrading devices to older vulnerable software and then using the access to reach `NETCONF` and manipulate SD-WAN fabric configuration, creating significant risk for federal networks and other exposed deployments. Additional research shows the campaign is not limited to a single bug. Cisco disclosed in-the-wild exploitation of **CVE-2026-20127** together with **CVE-2022-20775**, an older SD-WAN CLI flaw enabling post-auth privilege escalation and root command execution, while external analysis warned that public proof-of-concept material around `CVE-2026-20127` has been misattributed and may produce incomplete detections. Researchers also highlighted broader exposure across internet-facing SD-WAN Manager instances and warned that **CVE-2026-20133** may present underappreciated risk and could already be seeing exploitation, underscoring that defenders should treat the Cisco SD-WAN issue as an active intrusion and hardening priority rather than a routine patch cycle.
Jun 29, 2026
Attackers have actively exploited multiple vulnerabilities in **Cisco Catalyst SD-WAN Manager** (`vManage`) to bypass authentication, escalate privileges to **root**, and alter downstream network infrastructure. Reporting on the campaign says the intrusion chain used critical auth-bypass flaws `CVE-2026-20127` and `CVE-2026-20182` for initial access, then leveraged `CVE-2026-20245` to execute commands as root through crafted file upload and command injection in the CLI. Cisco confirmed limited incidents in which exploitation led to configuration changes being pushed to edge devices, raising the risk that compromise of a single controller could affect broad SD-WAN environments. Cisco also disclosed active exploitation of `CVE-2026-20262`, a separate zero-day in Cisco Catalyst SD-WAN Manager that lets an authenticated low-privilege attacker abuse file-upload handling to create or overwrite files on the underlying operating system and gain root privileges. The flaw affects on-premises, Cloud, Cloud-Pro, and FedRAMP deployments, and Cisco released fixes in versions `20.9.9.2`, `20.12.7.2`, `20.15.4.5`, `20.15.5.3`, `20.18.3.1`, and `26.1.1.2`. U.S. authorities added exploited Cisco SD-WAN flaws to the **Known Exploited Vulnerabilities** catalog, and CISA issued **Emergency Directive 26-03** directing federal agencies to hunt for compromise and rapidly harden affected systems.
Jul 7, 2026
Cisco disclosed and patched **CVE-2026-20182**, a critical `CVSS 10.0` authentication bypass flaw in **Cisco Catalyst SD-WAN Controller** and **Cisco Catalyst SD-WAN Manager** that has been exploited in the wild. The bug affects the `vdaemon` control-plane service over **DTLS/UDP 12346** and allows an unauthenticated attacker to impersonate a trusted peer, gain high-privilege administrative access, reach **NETCONF** on `TCP/830`, and manipulate SD-WAN fabric configuration. Rapid7 said the flaw stems from missing authentication checks when a peer claims to be a vHub device, enabling attackers to inject SSH keys for the `vmanage-admin` account and establish persistent access; Cisco said there are **no workarounds** and released fixed software versions for affected on-premises, cloud, managed-cloud, and FedRAMP deployments. Cisco Talos attributed the most sophisticated exploitation of `CVE-2026-20182` with high confidence to **UAT-8616**, which was observed adding SSH keys, modifying NETCONF settings, and escalating privileges to root, with infrastructure overlap noted with Operational Relay Box networks. Talos also reported broader ongoing attacks against SD-WAN environments, including widespread exploitation of previously disclosed **CVE-2026-20133**, **CVE-2026-20128**, and **CVE-2026-20122** after public proof-of-concept release, leading to deployment of JSP webshells such as **XenShell**, **Godzilla**, and **Behinder**, along with tools including Sliver, AdaptixC2, XMRig, gsocket, and credential-stealing scripts. **CISA added CVE-2026-20182 to the KEV catalog** and ordered federal agencies to remediate quickly, while Cisco and national cyber agencies urged organizations to preserve forensic evidence, review logs for unauthorized peering and `vmanage-admin` public-key logins, and patch all vulnerable control components immediately.
Jun 29, 2026