CISA and Partners Release Guidance for Ongoing Global Exploitation of Cisco SD-WAN Systems

CISA and international cybersecurity partners have issued a joint advisory warning of ongoing global exploitation of Cisco SD-WAN systems. Threat actors are actively leveraging CVE-2026-20127, a previously undisclosed authentication bypass vulnerability, to gain initial access to networks. Once inside, they escalate privileges using CVE-2022-20775 and establish long-term persistence. CISA has issued Emergency Directive 26-03 mandating that Federal Civilian Executive Branch agencies inventory, patch, and assess their Cisco SD-WAN deployments. The advisory includes comprehensive hardening guidance covering network perimeter controls, SD-WAN manager access, control/data plane security, session timeouts, and logging. Organizations worldwide are urged to immediately implement patches, collect forensic artifacts, and conduct threat hunting activities to detect potential compromise.

The purpose of this Alert is to provide resources for organizations with Cisco Software-Defined Wide-Area Networking (SD-WAN) systems, including Federal Civilian Executive Branch (FCEB) agencies, to address ongoing exploitation of multiple vulnerabilities. Notably, the Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20127 and CVE-2022-20775 to its Known Exploited Vulnerabilities (KEV) Catalog on Feb. 25, 2026. As a result of the malicious cyber activity and vulnerabilities involving Cisco SD-WAN systems, CISA has outlined requirements for FCEB agencies in Emergency Directive (ED) 26-03 to inventory Cisco SD-WAN systems, update them, and assess compromise. CISA and partners have observed malicious cyber actors targeting and compromising Cisco SD-WAN systems of organizations, globally. These actors have been observed exploiting a previously undisclosed authentication bypass vulnerability, CVE-2026-20127, for initial access before escalating privileges using CVE-2022-20775 and establishing long-term persistence in Cisco SD-WAN systems. CISA, National Security Agency (NSA), and international partners Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), Canadian Centre for Cyber Security (Cyber Centre), New Zealand National Cyber Security Centre (NCSC-NZ), and United Kingdom National Cyber Security Centre (NCSC-UK), hereafter the “authoring organizations,” strongly urge network defenders to immediately 1) inventory all in-scope Cisco SD-WAN systems, 2) collect artifacts, including virtual snapshots and logs off of SD-WAN systems to support threat hunt activities, 3) fully patch Cisco SD-WAN systems with available updates, 4) hunt for evidence of compromise, and 5) concurrently review Cisco’s latest security advisories, Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability and Cisco Catalyst SD-WAN Vulnerabilities , and implement Cisco’s SD-WAN Hardening Guidance . 1 To address malicious activity involving vulnerable Cisco SD-WAN systems, CISA issued Emergency Directive 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems , which outlines requirements for FCEB agencies to inventory Cisco SD-WAN systems, update them, and assess compromise. Further, CISA released Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems to provide prescriptive actions for FCEB agencies. Cisco’s Catalyst SD-WAN Hardening Guide recommends that network defenders address: Network perimeter controls : Ensure control components are behind a firewall, isolate virtual private network (VPN) 512 interfaces, and use internet protocol (IP) blocks for manually provisioned edge IPs. SD-WAN manager access : Replace the self-signed certificate for the web user interface. Control and data plane security : Use pairwise keys. Session timeout : Limit to the shortest period possible. Logging : Forward to a remote syslog server. CISA and the authoring organizations are providing the following resources: CISA: Emergency Directive 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems CISA: Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems Cisco: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability Cisco: Cisco Catalyst SD-WAN Vulnerabilities Cisco: Cisco Catalyst SD-WAN Hardening Guide ASD’s ACSC: Cisco SD-WAN Threat Hunt Guide , co-sealed by CISA, NSA, Cyber Centre, NCSC-NZ, and NCSC-UK. This guide, based on investigative data, supports network defenders’ detection of and response to the malicious actors’ threat activity Acknowledgements NSA, ASD’s ACSC, Cyber Centre, NCSC-NZ, and NCSC-UK contributed to this alert . Disclaimer The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA. Notes 1 Cisco Security, “Cisco Catalyst SD-WAN Hardening Guide,” last modified February 9, 2026, https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide

CISA and international cybersecurity partners have issued a joint advisory warning of ongoing global exploitation of Cisco SD-WAN systems. Threat actors are actively leveraging CVE-2026-20127, a previously undisclosed authentication bypass vulnerability, to gain initial access to networks. Once inside, they escalate privileges using CVE-2022-20775 and establish long-term persistence. CISA has issued Emergency Directive 26-03 mandating that Federal Civilian Executive Branch agencies inventory, patch, and assess their Cisco SD-WAN deployments. The advisory includes comprehensive hardening guidance covering network perimeter controls, SD-WAN manager access, control/data plane security, session timeouts, and logging. Organizations worldwide are urged to immediately implement patches, collect forensic artifacts, and conduct threat hunting activities to detect potential compromise. The purpose of this Alert is to provide resources for organizations with Cisco Software-Defined Wide-Area Networking (SD-WAN) systems, including Federal Civilian Executive Branch (FCEB) agencies, to address ongoing exploitation of multiple vulnerabilities. Notably, the Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20127 and CVE-2022-20775 to its Known Exploited Vulnerabilities (KEV) Catalog on Feb. 25, 2026. As a result of the malicious cyber activity and vulnerabilities involving Cisco SD-WAN systems, CISA has outlined requirements for FCEB agencies in Emergency Directive (ED) 26-03 to inventory Cisco SD-WAN systems, update them, and assess compromise. CISA and partners have observed malicious cyber actors targeting and compromising Cisco SD-WAN systems of organizations, globally. These actors have been observed exploiting a previously undisclosed authentication bypass vulnerability, CVE-2026-20127, for initial access before escalating privileges using CVE-2022-20775 and establishing long-term persistence in Cisco SD-WAN systems. CISA, National Security Agency (NSA), and international partners Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), Canadian Centre for Cyber Security (Cyber Centre), New Zealand National Cyber Security Centre (NCSC-NZ), and United Kingdom National Cyber Security Centre (NCSC-UK), hereafter the “authoring organizations,” strongly urge network defenders to immediately 1) inventory all in-scope Cisco SD-WAN systems, 2) collect artifacts, including virtual snapshots and logs off of SD-WAN systems to support threat hunt activities, 3) fully patch Cisco SD-WAN systems with available updates, 4) hunt for evidence of compromise, and 5) concurrently review Cisco’s latest security advisories, Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability and Cisco Catalyst SD-WAN Vulnerabilities , and implement Cisco’s SD-WAN Hardening Guidance . 1 To address malicious activity involving vulnerable Cisco SD-WAN systems, CISA issued Emergency Directive 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems , which outlines requirements for FCEB agencies to inventory Cisco SD-WAN systems, update them, and assess compromise. Further, CISA released Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems to provide prescriptive actions for FCEB agencies. Cisco’s Catalyst SD-WAN Hardening Guide recommends that network defenders address: Network perimeter controls : Ensure control components are behind a firewall, isolate virtual private network (VPN) 512 interfaces, and use internet protocol (IP) blocks for manually provisioned edge IPs. SD-WAN manager access : Replace the self-signed certificate for the web user interface. Control and data plane security : Use pairwise keys. Session timeout : Limit to the shortest period possible. Logging : Forward to a remote syslog server. CISA and the authoring organizations are providing the following resources: CISA: Emergency Directive 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems CISA: Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems Cisco: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability Cisco: Cisco Catalyst SD-WAN Vulnerabilities Cisco: Cisco Catalyst SD-WAN Hardening Guide ASD’s ACSC: Cisco SD-WAN Threat Hunt Guide , co-sealed by CISA, NSA, Cyber Centre, NCSC-NZ, and NCSC-UK. This guide, based on investigative data, supports network defenders’ detection of and response to the malicious actors’ threat activity Acknowledgements NSA, ASD’s ACSC, Cyber Centre, NCSC-NZ, and NCSC-UK contributed to this alert . Disclaimer The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply...