Cisco adds another SD-WAN box to max-severity bug advisory

1. Executive summary

Cisco has amended its February 2026 advisory for CVE-2026-20127 (CVSS 10.0, improper authentication) to add Cisco Catalyst SD-WAN Validator (formerly vBond) to the list of affected products. The flaw allows an unauthenticated remote attacker to obtain administrative privileges on vulnerable SD-WAN devices. Cisco Talos assesses the underlying bug may have been exploitable for up to three years prior to discovery, and attributes observed in-the-wild activity to a tracked cluster designated UAT-8616 — for which no MITRE ATT&CK profile exists; attribution to any specific nation-state or named group is therefore unconfirmed. The chained attack (CVE-2026-20127 → admin/NETCONF access → CVE-2022-20775 path traversal, CVSS 7.8 → root) yields persistent root on the SD-WAN fabric. EMEA financial services entities running Catalyst SD-WAN (Controller, Manager, or Validator) and that have not applied the February fixed software across all components are exposed to root takeover and persistent reconfiguration of the SD-WAN overlay.

2. Regulatory framing

Article	Trigger	Practical impact
DORA Art. 17	Active in-the-wild exploitation of CVE-2026-20127 (CVSS 10.0) and chained CVE-2022-20775 (CVSS 7.8) against SD-WAN infrastructure	Document and operate the ICT-related incident management process covering detection, triage, eradication and recovery for any compromise of SD-WAN components.
DORA Art. 18	Same exploitation activity against a critical ICT third-party component	Classify any observed compromise against the ICT-related incident classification criteria and record cyber-threat information.
DORA Art. 19	A confirmed compromise meeting major-incident criteria	Report major ICT-related incidents to the competent authority within the prescribed timelines.
DORA Art. 24	Need to validate resilience of the SD-WAN control/management plane	Include SD-WAN Validator, Controller and Manager in digital operational resilience testing scope.
DORA Art. 28	Cisco is an ICT third-party provider; CVE-2026-20127 affects a critical SD-WAN component	Maintain the ICT third-party risk register and ensure contractual notification/assurance flows with Cisco are exercised.
DORA Art. 29	Cisco SD-WAN is a concentration-risk candidate across many financial entities	Re-assess concentration risk given the expanded affected-product list (Validator now in scope).
DORA Art. 30	Vendor fix and hardening guidance issued by Cisco and NCSC-UK	Confirm Cisco contractual obligations on patches, advisories and threat-hunting guidance are being met.
NIS2 Art. 21(2)(d)	Supply-chain exposure via Cisco SD-WAN components	Apply supply-chain security measures covering selection, monitoring and incident handling for the SD-WAN vendor relationship.
NIS2 Art. 23	Any confirmed SD-WAN compromise meeting incident criteria	Trigger incident-reporting obligations under national transposing law.
UK NIS 2018	UK OES/RDSP operators running affected Cisco SD-WAN	Apply NCSC-UK threat-hunting guidance and report compromises to the NCSC.

3. Technical analysis & attack chain

Affected products (per Cisco's amended advisory)

Cisco Catalyst SD-WAN Controller
Cisco Catalyst SD-WAN Manager
Cisco Catalyst SD-WAN Validator (formerly vBond) — newly added in this amendment

Primary vulnerability — CVE-2026-20127 (CVSS 10.0, improper authentication)

Unauthenticated remote attacker bypasses authentication and obtains administrative privileges on the affected SD-WAN component.
Talos assesses the underlying defect may have been exploitable for up to three years before disclosure.

Chained secondary — CVE-2022-20775 (CVSS 7.8, path traversal)

Disclosed September 2022; abused in the same campaign to escalate from administrative access to root on the underlying system.

Attack chain (confirmed by Cisco / Talos)

Initial access / privilege gain. Exploit CVE-2026-20127 against an internet- or management-plane-reachable SD-WAN Controller, Manager or Validator to obtain administrative privileges without valid credentials.
Fabric reconfiguration. Use the admin session to access NETCONF and reconfigure the SD-WAN overlay (e.g., add a rogue peer / vSmart / vBond to the fabric to maintain persistence).
Privilege escalation to root. Exploit CVE-2022-20775 (path traversal) against the now-admin-controlled device to gain root on the underlying OS.
Persistence. Maintain access via the rogue peer and any local persistence established with root; Talos notes activity dating to at least 2023, indicating long-dwell tradecraft.
Follow-on. From root on the SD-WAN control plane, the attacker can pivot into the data plane, intercept or steer traffic, and stage further intrusion into the wider enterprise.

CVE-2026-20245 — high-severity validation error in SD-WAN Manager; exploited as a zero-day; requires netadmin privileges (or chaining from CVE-2026-20182 / CVE-2026-20127); affects all versions and all deployment types (on-prem, cloud, FedRAMP). No patch at time of disclosure.
CVE-2026-20262 — directory/path traversal in SD-WAN Manager; exploited in the wild; allows file creation/overwrite leading to root. Listed in CISA KEV with a due date of 2026-06-29.
CVE-2026-20182 — max-severity authentication bypass in SD-WAN Controller & Manager; listed in CISA KEV with a due date of 2026-05-17.
CVE-2026-20128 / CVE-2026-20133 / CVE-2026-20122 — three SD-WAN Manager bugs under active attack; fixed in late February 2026.
CVE-2026-20230 — critical Unified Communications Manager bug with public PoC; root-level impact (out of scope for this advisory but noted for situational awareness).

Attribution note. Cisco Talos tracks the cluster as UAT-8616 with activity dating to at least 2023. No MITRE ATT&CK profile exists for this designation and no country or group has been formally attributed; treat any nation-state attribution as unconfirmed. NCSC-UK characterises the actor as "highly sophisticated" with a history of targeting critical infrastructure sectors.

Unconfirmed / single-sourced claims. The Register's framing that the February patch "should" cover Validator if customers upgraded "all systems" is Cisco's stated position; we have not independently verified whether every fixed release published in February covers Validator specifically. Treat as confirmed only after validating the running software version against Cisco's published fixed-software matrix for CVE-2026-20127.

4. Mitigation & containment

P1 — within 24 hours

Identify exposure. Inventory every Cisco Catalyst SD-WAN component (Controller, Manager, Validator) and record the running software version. Cross-check against Cisco's fixed-software matrix for CVE-2026-20127.
Patch / upgrade. Move to the fixed software released in February 2026 for CVE-2026-20127 across all components, not only Controller and Manager. If Validator was not previously upgraded, upgrade it now.
Restrict management-plane exposure. Place SD-WAN Controller, Manager and Validator management interfaces behind ACLs / VPN / jump host; deny direct internet exposure. Block NETCONF and management web/API ports from untrusted networks.
Hunt using NCSC-UK / Five Eyes guidance. Apply the joint threat-hunting advice referenced in the original February alert (rogue peers, unauthorised vSmart/vBond additions, unexpected NETCONF sessions, anomalous file writes consistent with CVE-2022-20775 path traversal).

P2 — within 72 hours

Apply CISA KEV mitigations for the related in-the-wild CVEs:
CVE-2026-20182 — apply the May 2026 fixed software as a protective measure (per Cisco's own recommendation).
CVE-2026-20262 — apply vendor instructions per BOD 26-04; due 2026-06-29.
Credential rotation. Rotate any credentials, API keys or certificates used by or stored on SD-WAN components; assume admin-level compromise is possible until proven otherwise.
NETCONF / control-plane audit. Review NETCONF session logs and configuration diffs for unauthorised peers, route-policy changes, or template pushes predating the patch window.

P3 — within 7 days

Hardening. Enforce MFA on any out-of-band access path to SD-WAN components; disable unused NETCONF/RESTCONF users; enable Cisco's recommended hardening guidance.
Detection tuning. Deploy the Sigma rule in §6 and any vendor-supplied IOCs; ensure SD-WAN syslog/AAA feeds are retained for at least 180 days.
Third-party risk file. Update the DORA Art. 28 / NIS2 Art. 21(2)(d) third-party risk record to reflect the expanded affected-product list and the chained CVE-2022-20775 exposure.

5. Indicators of compromise

No indicators of compromise (file hashes, IPs, domains, filenames) are present in the source material. The only directly observable artefacts are the CVE identifiers and product names listed above.

No indicators of compromise available in the source material.

6. Detection

Insufficient indicators to author detection rules.

7. Sources

The Register — Cisco adds another SD-WAN box to max-severity bug advisory (2026-06-17): https://www.theregister.com/security/2026/06/17/cisco-adds-another-sd-wan-box-to-max-severity-bug-advisory/5257621
The Register — Yet another Cisco SD-WAN 0-day under attack, and no patch in sight (2026-06-05): https://www.theregister.com/security/2026/06/05/yet-another-cisco-sd-wan-0-day-under-attack-and-no-patch-in-sight/5251855
BleepingComputer — Cisco fixes SD-WAN vManage flaw exploited in zero-day attacks: https://www.bleepingcomputer.com/news/security/cisco-fixes-sd-wan-vmanage-flaw-exploited-in-zero-day-attacks/
BleepingComputer — Cisco warns of unpatched SD-WAN zero-day exploited in attacks: https://www.bleepingcomputer.com/news/security/new-cisco-sd-wan-flaw-exploited-in-zero-day-attacks-to-gain-root/
Help Net Security — Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262) (2026-06-16): https://www.helpnetsecurity.com/2026/06/16/cisco-sd-wan-cve-2026-20262-exploited/
CISA KEV — CVE-2026-20182: https://nvd.nist.gov/vuln/detail/CVE-2026-20182
CISA KEV — CVE-2026-20262: https://nvd.nist.gov/vuln/detail/CVE-2026-20262

8. Adverse Trace position

Severity: Critical. CVE-2026-20127 is a CVSS 10.0 unauthenticated admin-bypass chained with a CVSS 7.8 path-traversal to root, on a product family that is heavily concentrated across EMEA financial services. The amendment adding SD-WAN Validator materially raises exposure for any entity that patched only Controller and Manager in February. Client impact: any EMEA financial entity running unpatched Catalyst SD-WAN Controller, Manager or Validator should be treated as potentially compromised until proven otherwise; hunt per NCSC-UK / Five Eyes guidance and rotate credentials. Next steps: Adverse Trace will (a) re-issue this advisory if Cisco publishes a new fixed-software matrix entry specific to Validator, (b) monitor for CISA KEV listing of CVE-2026-20127 and CVE-2026-20245, and (c) update the third-party risk record under DORA Art. 28 / NIS2 Art. 21(2)(d) for affected clients.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.