Cisco Catalyst SD-WAN Vulnerabilities Allow Attackers to Gain Root Access

Cisco issued an urgent advisory for multiple critical vulnerabilities in Cisco Catalyst SD‑WAN Manager — led by CVE‑2026‑20129 (authentication bypass, CVSS 9.8) — that can allow unauthenticated attackers or low‑privilege users to gain netadmin/root access, overwrite system files, and steal plaintext credentials; CVE‑2026‑20122 and CVE‑2026‑20128 are reported as being actively exploited. Cisco recommends immediate upgrades to fixed releases (for example 20.9.8.2, 20.12.5.3, or 20.18.2.1), restricting internet access to the management portal, disabling unused services, and enforcing strict firewall rules.