--- title: Cisco SD-WAN Zero-Day Under Exploitation for 3 Years description: Cisco has disclosed a maximum-severity authentication bypass zero-day (CVE-2026-20127, CVSS 10) in its Catalyst SD-WAN Controller that has been actively... canonical: https://daily.dev/posts/cisco-sd-wan-zero-day-under-exploitation-for-3-years-7pux2ulud twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cisco SD-WAN Zero-Day Under Exploitation for 3 Years | daily.dev og:description: Cisco has disclosed a maximum-severity authentication bypass zero-day (CVE-2026-20127, CVSS 10) in its Catalyst SD-WAN Controller that has been actively... og:url: https://daily.dev/posts/cisco-sd-wan-zero-day-under-exploitation-for-3-years-7pux2ulud og:image: https://api.daily.dev/og/posts/7Pux2ULud.png og:image:alt: Cisco SD-WAN Zero-Day Under Exploitation for 3 Years og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cisco SD-WAN Zero-Day Under Exploitation for 3 Years **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary Cisco has disclosed a maximum-severity authentication bypass zero-day (CVE-2026-20127, CVSS 10) in its Catalyst SD-WAN Controller that has been actively exploited for at least three years since 2023. The threat actor, tracked as UAT-8616, used the flaw to add rogue peers to SD-WAN management systems, then chained it with a software version downgrade to exploit a second older vulnerability (CVE-2022-20775) for local privilege escalation and root access. CISA issued an emergency directive requiring federal agencies to patch by Friday. The attacker left minimal forensic evidence and no C2 malware or lateral movement was observed. Nation-state actors including Salt Typhoon and Volt Typhoon are suspected given their history of targeting Cisco devices. Mitigations include patching, restricting internet exposure, disabling HTTP access to the admin portal, and enabling centralized logging. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Cisco warns of unpatched SD-WAN zero-day exploited in attacks](https://daily.dev/posts/cisco-warns-of-unpatched-sd-wan-zero-day-exploited-in-attacks-y5x7rn4ph) · BleepingComputer · 0 upvotes · 0 comments - [Zero-Day Exploitation of Vulnerability \(CVE-2026-20245\) in Cisco Catalyst SD-WAN Manager](https://daily.dev/posts/zero-day-exploitation-of-vulnerability-cve-2026-20245-in-cisco-catalyst-sd-wan-manager-iuhsybebg) · Google Cloud · 0 upvotes · 0 comments - [Attackers Hit Cisco SD-WAN Flaw 2 Months Before Disclosure](https://daily.dev/posts/attackers-hit-cisco-sd-wan-flaw-2-months-before-disclosure-ci5ffvcvz) · Dark Reading · 0 upvotes · 0 comments - [Cisco warns of two more SD-WAN bugs under active attack](https://daily.dev/posts/cisco-warns-of-two-more-sd-wan-bugs-under-active-attack-t3izwwzac) · The Register · 0 upvotes · 0 comments --- Tags: [#cisco](https://daily.dev/tags/cisco), [#networking](https://daily.dev/tags/networking), [#security](https://daily.dev/tags/security), [#vulnerability](https://daily.dev/tags/vulnerability), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/cisco-sd-wan-zero-day-under-exploitation-for-3-years-7pux2ulud) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cisco SD-WAN Zero-Day Under Exploitation for 3 Years","url":"https://daily.dev/posts/cisco-sd-wan-zero-day-under-exploitation-for-3-years-7pux2ulud","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisco-sd-wan-zero-day-under-exploitation-for-3-years-7pux2ulud"},"datePublished":"2026-02-26T22:04:59.058Z","dateModified":"2026-03-15T03:43:47.498Z","description":"Cisco has disclosed a maximum-severity authentication bypass zero-day (CVE-2026-20127, CVSS 10) in its Catalyst SD-WAN Controller that has been actively...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8e6a1a2c7dc2b7188b911a7fe6817b73?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8e6a1a2c7dc2b7188b911a7fe6817b73?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisco-sd-wan-zero-day-under-exploitation-for-3-years-7pux2ulud","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cisco,networking,security,vulnerability,zero-day","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Cisco SD-WAN Zero-Day Under Exploitation for 3 Years"}]} ```