Cisco SD-WAN Security Alert: A Critical Issue for Global Organizations
A Global Warning: Protect Your Cisco SD-WAN Devices Now!
The Five Eyes intelligence alliance is sounding the alarm, urging organizations worldwide to take immediate action to secure their Cisco SD-WAN devices. The alliance's alert highlights a critical vulnerability that could grant hackers root access and persistent control over these devices. But here's where it gets controversial: while the alliance provides guidance, the responsibility ultimately lies with individual organizations to patch their systems and protect against this threat.
The issue stems from two vulnerabilities in Cisco Catalyst SD-WAN devices. The first, CVE-2022-20775, is a path traversal vulnerability that allows for privilege escalation. The second, CVE-2026-20127, is a more severe issue, earning a perfect 10 CVSS score. This vulnerability, classified as an improper authentication flaw, affects the Cisco Catalyst SD-WAN Controller and Manager, formerly known as SD-WAN vSmart and vManage. The latter vulnerability is particularly concerning, as successfully exploiting it grants hackers admin rights, allowing them to access NETCONF and reconfigure the SD-WAN fabric at their whim.
According to a report from Cisco Talos, the vendor has attributed the attacks using CVE-2026-20127 to a group tracked as UAT-8616. Current signals suggest that this group has been exploiting the vulnerability since at least 2023. While the intelligence agencies and Cisco have not revealed precise details about the vulnerabilities, Talos's report suggests that CVE-2026-20127 was exploited first to gain admin rights, followed by the use of CVE-2022-20775 to downgrade the SD-WAN's software version and gain root access.
The impact of these vulnerabilities is significant. An undisclosed number of attacks have already been carried out, targeting high-value, sensitive sectors. Defenders are urged to follow the Five Eyes Hunt Guide to find signs of compromise and take action. If compromised, organizations should share data with relevant security authorities and upgrade to the latest version of Cisco Catalyst SD-WAN Controller/Manager.
The NCSC CTO, Ollie Whitehouse, emphasizes the urgency of the situation, stating that organizations using Cisco Catalyst SD-WAN products should investigate their exposure to network compromise and hunt for malicious activity. UK organizations are advised to report compromises to the NCSC and apply vendor updates and hardening guidance to reduce the risk of exploitation.
But here's the catch: While the Five Eyes alliance provides guidance, the responsibility to patch and protect ultimately lies with individual organizations. Will you take the necessary steps to safeguard your Cisco SD-WAN devices? The clock is ticking, and the consequences of inaction could be severe.
