Cisco and Cisco Talosdisclosed that a sophisticated threat actor, tracked as UAT-8616, has been exploiting a zero-day vulnerability in Cisco Catalyst SD-WAN Controllerssince at least 2023.

CVE-2026-20127: The Zero-Day

• The Flaw: An authentication bypass in the peering mechanism allows unauthenticated remote attackers to gain high-privileged administrative access.
• The Discovery: The campaign was identified by the Australian Signals Directorate (ASD) and analyzed by Cisco Talos.
• Long-Term Stealth: The actor maintained access for years by adding “rogue peers” to the SD-WAN fabric and downgrading software versions to exploit older vulnerabilities like CVE-2022-20775for root escalation.

How to Respond

• Patch Immediately: Check the Cisco Security Advisory for fixed software releases for Catalyst SD-WAN (vSmart) and vBond orchestrators.
• Inspect Controllers: Audit your network for any unauthorized peering requests or unexplained administrative accounts.
• Monitor Software History: Look for evidence of unauthorized version downgrades, which the attacker used to bypass modern security controls.