yonathanpy/cve-2026-20127-cisco-sd-wan-preauth-rceProof-of-concept exploit for CVE-2026-20127, a pre-authentication RCE in Cisco SD-WAN, demonstrating rogue peer registration and authentication bypass for research and defensive testing.
This repository contains a proof-of-concept (PoC) exploit for CVE-2026-20127, a critical pre-authentication remote code execution (RCE) vulnerability affecting Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage) deployments.
The vulnerability allows a remote, unauthenticated attacker to interact directly with management and control plane components of Cisco SD-WAN infrastructure, ultimately leading to full administrative compromise of the SD-WAN fabric.
According to public reporting and vendor analysis, this vulnerability has been actively exploited in the wild since at least 2023. Cisco attributes exploitation activity to a sophisticated threat cluster identified as UAT-8616, which has leveraged the flaw to gain persistent administrative access to exposed SD-WAN environments.
Because Cisco SD-WAN is widely deployed in enterprise WAN infrastructure, service provider networks, and critical infrastructure environments, successful exploitation can have significant operational and security implications, including full control over network orchestration and routing behavior across geographically distributed networks.
This repository provides a research-oriented implementation of the exploit to assist security researchers, defenders, and network administrators in understanding the vulnerability mechanics and improving detection and mitigation strategies.
CVE ID: CVE-2026-20127
Affected Platforms:
Vulnerability Class:
Impact Level: Critical
The vulnerability stems from insufficient validation of specific control-plane communication paths within the SD-WAN management infrastructure. By crafting a malicious interaction with the management interface, an attacker can register a rogue peer within the SD-WAN control plane and escalate privileges without possessing valid credentials.
Once the malicious peer is accepted by the control plane, the attacker gains the ability to interact with internal management services and perform privileged operations.
Security investigations have identified active exploitation campaigns beginning in 2023, targeting exposed Cisco SD-WAN management endpoints.
Cisco attributes these attacks to UAT-8616, a threat actor cluster characterized by:
Observed attacker behavior includes:
The exploitation of SD-WAN infrastructure is particularly dangerous because compromise at the orchestration layer enables global network manipulation across all connected sites.
Successful exploitation of CVE-2026-20127 may allow an attacker to perform the following actions:
Attackers can create and register a malicious peer node that joins the SD-WAN management/control plane infrastructure. Once accepted by the controller, the rogue peer can interact with internal components as a trusted device.
The vulnerability allows attackers to bypass authentication mechanisms entirely, eliminating the need for valid administrative credentials.
By interacting with internal services after initial access, the attacker can obtain full administrative privileges over the SD-WAN management interface.
The exploit enables attackers to interact with the NETCONF service exposed on TCP port 830, which is used for network configuration management.
NETCONF access may allow attackers to:
Because Cisco SD-WAN uses centralized orchestration, an attacker with administrative control can:
In large deployments, this effectively provides control over the entire WAN infrastructure.
This repository contains a research-grade proof-of-concept implementation demonstrating exploitation of CVE-2026-20127.
The PoC is designed to illustrate:
The implementation is intentionally structured for analysis and reproducibility in controlled testing environments.
This project is intended for:
It allows defenders and researchers to better understand:
This exploit should only be executed within controlled laboratory environments such as:
Testing against production systems without authorization is strongly discouraged and may violate applicable laws or policies.
This repository and all associated code are provided strictly for educational, research, and defensive security purposes.
By accessing, downloading, or using any material in this repository, you agree to the following conditions:
Unauthorized exploitation of vulnerabilities against systems without permission is illegal in many jurisdictions.
ZeroZenX
Contributions that improve documentation, analysis, or defensive insights related to the vulnerability are welcome.
Please ensure that contributions remain aligned with the repository's research and defensive security focus.
Credit goes to the security researchers and incident response teams who investigated and disclosed exploitation activity associated with CVE-2026-20127 and helped bring awareness to the risks affecting Cisco SD-WAN infrastructure.
Their work helps defenders better understand emerging threats targeting modern network orchestration platforms.
