Cisco SD-WAN Zero-Day Under Exploitation for 3 Years

Cisco disclosed a critical CVE-2026-20127 authentication-bypass zero-day in Catalyst SD-WAN Controllers that has been exploited in the wild since at least 2023 by a highly sophisticated actor tracked as UAT-8616; the actor added rogue peers, downgraded controllers to exploit CVE-2022-20775 for root escalation, and created persistent accounts. CISA issued an emergency directive to federal agencies to patch immediately, and intelligence partners published a 41-page hunt guide with mitigation steps including patching to fixed versions, disabling HTTP admin access, restricting Internet exposure, and hunting for rogue peering, downgrades, and unexpected reboots.