Peering authentication bypass grants unauthenticated admin on Cisco Catalyst SD-WAN Controller and Manager (CVE-2026-20127)
Cisco Talos published a new report on 2026-10-28 tying this flaw to historical UAT-11473 intrusions, BleepingComputer the same day reported Volt Typhoon using it as a zero-day, and Cisco revised its advisory on 2026-10-28 — a controller or manager still on an affected release remains open to unauthenticated takeover of the whole fabric.
A flaw in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller (vSmart), Manager (vManage) and Validator (vBond) lets an unauthenticated remote attacker send crafted requests and log in as an internal high-privileged non-root account. From there the attacker reaches NETCONF and can rewrite the configuration of the entire SD-WAN fabric; no workaround exists and public exploit code is available.
Affected: Cisco Catalyst SD-WAN Manager releases earlier than 20.9, and 20.9 through 20.18 releases before the first fixed release for their train in advisory cisco-sa-sdwan-rpa-EHchtZk; Cisco Catalyst SD-WAN Controller (vSmart) and Validator (vBond) releases covered by advisory cisco-sa-sdwan-rpa-EHchtZk
How to Test
Check the running release on each SD-WAN Manager, Controller and Validator against the affected list in Cisco advisory cisco-sa-sdwan-rpa-EHchtZk (Cisco bug CSCws52722). To look for compromise, review authentication logs on Controllers and Managers for logins by the internal high-privileged non-root peering account from unexpected peers, audit NETCONF sessions and configuration changes to the fabric that no administrator made, and run the hunts in CISA's Hunt & Hardening Guidance for Cisco SD-WAN Devices referenced by Emergency Directive 26-03.
How to Patch
Upgrade every Catalyst SD-WAN Manager, Controller and Validator to the fixed software release Cisco lists for your release train in advisory cisco-sa-sdwan-rpa-EHchtZk; Cisco states there are no workarounds. Where an upgrade cannot happen immediately, follow CISA Emergency Directive 26-03 mitigation steps and restrict network reachability of the controller peering interfaces to known peers.