Global Cyber Agencies Urge Immediate Patching of Cisco SD-WAN Zero Day

The report describes a critical, actively exploited zero-day (CVE-2026-20127) in Cisco Catalyst SD‑WAN Controller/Manager that allows unauthenticated attackers to bypass authentication, obtain high-privilege access, and manipulate NETCONF; Five Eyes agencies and CISA have issued guidance and an emergency directive to patch immediately, and investigators report attackers used a downgrade to exploit a legacy LPE (CVE-2022-20775) to escalate to root and maintain persistence.