CyberzSOC

Malicious cyber threat actors are targeting Software-Defined Wide Area Networks (SDWANs) of organizations globally. These actors exploited a Cisco Catalyst SD-WAN controller authentication bypass vulnerability, CVE-2026-20127. After exploitation of this vulnerability the malicious actors add a rogue peer, and eventually gain root access to establish long-term persistence in SD-WANs. The following agencies, hereafter referred to as the authoring organizations, released a Cisco SD-WAN Threat Hunt Guide, based on investigative data, to support network defenders’ detection of and response to the malicious actors’ threat activity. The Hunt Guide is being released by the following authoring and co-sealing agencies: The authoring organizations strongly urge network defenders to: Catalyst SD-WAN Controller Authentication Bypass Vulnerability, and fully patch SD-WAN technology, including for CVE-2026-20127; Cisco’s Catalyst SD-WAN hardening guidance should be reviewed in full and includes isolate VPN 512 interfaces, and use IP blocks for manually provisioned edge IPs. PP-26-0656 | February 2026 Ver. 1.0 Cyber Centre, NCSC-NZ, and NCSC-UK Notices and contact information The information and opinions contained in this document are provided "as is" and without any warranties or guarantees.