sign in--:--:--UTC

CVE-2026-20127

exploited in the wild

CVSS

10.0

Reports

16

First seen

Feb 26

Last seen

Jun 25

Affected product

Cisco SD-WAN

Associated actors

UAT-8616 ×8 Ghostwriter ×1 Lotus Blossom ×1 Oldphantomoftheopera ×1 Oleksii Oleksiyovych Lytvynenko ×1 ShinyHunters ×1 TeamPCP ×1 APT28 ×1 UNC6201 ×1

Recent reports

Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited for Root Access

The Hacker NewsJun 25 High

Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access

Bleeping ComputerJun 24 Critical

Attacker exploits Cisco SD-WAN zero-day to gain root access at communications service provider

CyberScoopJun 24 High

ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories

The Hacker NewsJun 18 High

Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw

The Hacker NewsJun 16 High

Cisco SD-WAN Manager Zero-Day Under Active Exploitation

CyberScoopJun 9 High

Cisco Catalyst SD-WAN Manager CVE-2026-20245 Actively Exploited – Patch Unavailable

The Hacker NewsJun 6 High

Cisco warns of unpatched SD-WAN zero-day exploited in attacks

Bleeping ComputerJun 5 High

Weekly Threat Recap: Exchange 0-Day, npm Supply Chain Attacks, Cisco Exploits

The Hacker NewsMay 18 Critical

CISA Adds Cisco SD-WAN Authentication Bypass CVE-2026-20182 to KEV Catalog

The Hacker NewsMay 15 Critical

Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited for Admin Access

The Hacker NewsMay 14 High

Cisco Talos tracks active exploitation of Catalyst SD-WAN vulnerabilities

Cisco TalosMay 14 Critical

February 2026 CVE Landscape: 13 Critical Vulnerabilities, 43% Drop from January

Recorded Future InsiktMar 12 Critical

Cisco Catalyst SD-WAN authentication bypass vulnerabilities (CVE-2026-20127, CVE-2026-20129)

NICS TaiwanMar 5 Critical

Multiple Critical Vulnerabilities in Cisco Catalyst SD-WAN Controllers and Managers

CERT-EU AdvisoriesFeb 26 Critical

Multiple Vulnerabilities in Cisco Products Being Exploited in the Wild

GovCERT.HKFeb 26

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans