CyberzSOC

If exploited, these vulnerabilities could allow attackers to gain administrative access to It is recommended to capture forensic evidence, hunt for indicators of compromise, and apply One of the vulnerabilities, CVE-2026-20127, is exploited in the wild since 2023. [4] Vulnerabilities Affecting Cisco Catalyst SD-WAN Controller The vulnerability CVE-2026-20127, with the CVSS score of 10, is an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vManager. Successful exploitation allows a remote, unauthenticated attacker to obtain administrative privileges on An attacker could then modify configurations, add rogue devices to the SD-WAN fabric, extract sensitive configuration data, or establish persistent access. [1] This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.