p3nt3st3r-star/cve-2026-20131-pocProof-of-concept exploit for CVE-2026-20131, a pre-authentication RCE in Cisco Catalyst SD-WAN Controller and Manager, enabling admin access and network configuration manipulation.
Cisco SD-WAN Zero-Day CVE-2026-20131 Exploited Since 2023 for Admin Access.
This repository contains a working proof-of-concept exploit for CVE-2026-20131, a critical pre-authentication vulnerability in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Catalyst SD-WAN Manager (formerly vManage) that has been actively exploited in the wild since 2023.
This vulnerability has been actively exploited in the wild since 2023. The threat actor cluster (UAT-8616) , described by Cisco as a "highly sophisticated cyber threat actor," has been using this zero-day to compromise Cisco SD-WAN deployments globally.
Create rogue peer joined to management/control plane
Bypass authentication entirely
Obtain administrative privileges
Access NETCONF on port 830
Manipulate network configuration for SD-WAN fabric
You will only test on systems you own or have explicit written permission to test
You will not use this for any illegal, unauthorized, or malicious activities
You accept full responsibility for any consequences resulting from the use of this code
ZeroZenX not liable for any damages or legal issues arising from misuse
