randeepajayasekara/cve-2026-20127Walkthrough of the CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN from first malformed peering request to root on the management plane.
| # | Section | What's In It |
|---|
| 01 | SD-WAN Crash Course | The basics I needed to learn before any of this made sense — architecture, NETCONF, and how peering auth works |
| 02 | The Bouncer Problem | Where the auth code goes wrong — the happy path vs. the broken path, and the analogy that finally made it click for me |
| 03 | First Try, First Fail | My first attempt at understanding the exploit — it works! ...sort of. We hit a wall. |
| 04 | The Aha Moment | The key insight that unlocks the whole thing — turns out the bypass gives you way more than I initially thought |
| 05 | Keys to the Kingdom | What you can actually do once you're inside — NETCONF recon, rogue peer injection, full management-plane takeover |
| 06 | Full Kill Chain | The complete attack from start to finish, with every log artifact annotated — including the terrifyingly clever evasion technique |
| 07 | Patching the Hole | What the fix changed (it's almost embarrassingly simple), why firewall rules aren't enough, and what to do right now |
Hey, so I spent the last couple of weeks going down the rabbit hole on CVE-2026-20127 and I wanted to write up what I found. This is a 10.0/10.0 CVSS — literally the highest score possible — and it's a pre-authentication bypass in the control-plane peering mechanism of Cisco Catalyst SD-WAN Controller (vSmart) and SD-WAN Manager (vManage).
If you've read the Cisco advisory or the CISA Emergency Directive ED-26-03, you probably noticed the same thing I did: they tell you what to patch but not why it's broken. Like, "improper authentication" — okay, but how? What's actually happening under the hood?
That bugged me, so I dug in. This walkthrough is my attempt to explain what I figured out.
Most auth bypasses I've read about get you into a web dashboard or a REST API. Annoying? Sure. But this one lands you in the SD-WAN control plane — the thing that decides how every branch office, data center, and cloud edge in your network talks to each other. An attacker who gets past this doesn't just read configs. They can rewrite your entire WAN in real time, add rogue peers, and even pivot to root through chained exploitation.
Oh, and the wildest part? A threat actor called UAT-8616 has apparently been exploiting this since at least 2023. The CVE was only publicly disclosed on February 25, 2026. Three years. That's... a lot.
Note: I want to be super clear about this — everything here is reconstructed from public sources. Cisco advisories, CISA/ACSC guidance, Cisco Talos reporting, patch notes, and protocol specs. I do not have access to Cisco's proprietary source code. All the code you'll see is pseudocode or protocol-level reconstruction that I pieced together from how the system behaves, what the patches change, and what the advisories describe.
I'm basically a learning dev who got really interested in this CVE, so if I get any details wrong, please let me know. But I've tried to be as accurate as possible while keeping things approachable.
| Component | Affected Range | Fixed In |
|---|---|---|
| SD-WAN Controller (vSmart) | 20.16.1 – 20.18.2.1 | 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.18.2.1+ |
| SD-WAN Manager (vManage) | 20.16.1 – 20.18.2.1 | 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.18.2.1+ |
Honestly, I wrote this mainly for people like me — security folks who aren't Cisco SD-WAN experts but want to understand what's actually going on with a CVSS 10.0. But it should also be useful for:
Next Section: SD-WAN Crash Course →
