The Three-Year Shadow: Critical CVSS 10 Cisco SD-WAN Zero-Day Exploited by UAT-8616

Cisco Talos warns of active, ongoing exploitation of CVE-2026-20127 in Cisco Catalyst SD-WAN Controller that allows unauthenticated remote attackers to bypass authentication, gain high-privileged admin access, and manipulate NETCONF configuration; the activity is tracked as cluster UAT-8616, has been observed since 2023, includes a downgrade-to-exploit privilege escalation using CVE-2022-20775, and Cisco recommends applying fixed releases and restricting controller connectivity.