Zero Radar
← feed
CriticalVulnerabilityCVE-2026-20127updated 29 Oct 2026, 18:39 UTC

Cisco SD-WAN controller login bypass lets attackers take admin control

Attackers can sneak into the systems that manage a company's SD-WAN network without a password and gain admin rights. From there they can change how the network is set up and steal the keys that encrypt traffic.

Attacks reported (The Hacker News, SecurityWeek)Fix availableOfficial, 4 sources
SeverityCriticalVulnerability
Being exploited?ReportedBy The Hacker News, SecurityWeek, not officially confirmed yet
Fix available?YesCisco has released software updates; specific fixed versions unknown from the provided material. No workarounds exist. · since 28 Oct 2026
How sure is this?Official, 4 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerSends crafted requests to the controller
  2. 2Peering auth bypassedFlawed peering authentication accepts the attacker
  3. 3Admin account obtainedLogs in as internal high-privileged non-root user
  4. 4NETCONF accessAttacker reaches SD-WAN fabric configuration
  5. 5KeyDrift deployedMalware copies traffic encryption keys
  6. ResultAttacker controls SD-WAN network and steals keys

What happened

An authentication bypass in the peering authentication of Cisco Catalyst SD-WAN Controller, SD-WAN Manager and SD-WAN Validator lets an unauthenticated remote attacker log in as an internal high-privileged non-root account and access NETCONF to change SD-WAN fabric configuration.

Why it is dangerous: A successful attacker can manipulate the configuration of the entire SD-WAN fabric and, as reported, deploy KeyDrift malware that copies traffic encryption keys. Organizations running these Cisco SD-WAN management components are at risk.

Are you affected?

You are affected if you run Cisco Catalyst SD-WAN Controller (vSmart), SD-WAN Manager (vManage) or SD-WAN Validator (vBond) with a version that lacks Cisco's fix.

Cisco Catalyst SD-WAN Controller (formerly vSmart), Cisco Catalyst SD-WAN Manager (formerly vManage), Cisco Catalyst SD-WAN Validator (formerly vBond); specific affected versions unknown from the provided material.

What to do

  1. Update Cisco Catalyst SD-WAN Controller, Manager and Validator to the fixed software release in Cisco advisory cisco-sa-sdwan-rpa-EHchtZk
  2. Review the SD-WAN controllers for signs of unauthorized logins or configuration changes, and check for the KeyDrift malware
  3. If compromise is suspected, rotate the keys and credentials used to encrypt traffic between sites

Timeline

  1. 28 Oct 2026, 21:54 UTC
    Publicly disclosed
  2. 28 Oct 2026, 21:54 UTC
    Reported by Cisco PSIRT · Cisco PSIRT
  3. 28 Oct 2026, 21:58 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 08:53 UTC
    The Hacker News reported on it · The Hacker News
  5. 29 Oct 2026, 08:53 UTC
    Reported by The Hacker News
  6. 29 Oct 2026, 10:31 UTC
    SecurityWeek reported on it · SecurityWeek
  7. 29 Oct 2026, 18:39 UTC
    BleepingComputer reported on it · BleepingComputer

Sources 4 reports, oldest first

Official vendor, government CERT or advisory database

Security press established security newsrooms

Technical details

ID
CVE-2026-20127
Disclosed
28 Oct 2026, 21:54 UTC
On Zero Radar
28 Oct 2026, 21:58 UTC (4 min after disclosure)
Last change
29 Oct 2026, 18:39 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco SD-WAN controller login bypass lets attackers take admin control · Zero Radar