Skip to content
Sign in

Cisco product

Catalyst SD-WAN Controller and Manager

Alert
No CISA KEV deadline is open. CISA last added a Catalyst SD-WAN Controller and Manager CVE on 25 Feb.

Tracked since 25 Feb · latest article 30 Sep · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 1 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date1

Catalyst SD-WAN Controller and Manager CVEs in CISA KEV with their federal deadlines. None is open.

Exploited Catalyst SD-WAN Controller and Manager CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2026-20127Catalyst SD-WAN Controller and Manager25 FebPassed 27 Feb20
Vendor CSV of 101 entries for CiscoAll 101 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds Catalyst SD-WAN Controller and Manager CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’251Q1 ’260Q2 ’260Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20261
Q2 20260
Q3 20260
Q4 20260

Fix listed

1 of 1 CVE in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-20127: 99.8th percentile, in CISA KEV050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-2012799.8

Coverage20 articles · all time

The latest 20 articles naming Catalyst SD-WAN Controller and Manager, in the shared story grammar.

Full timeline
Quiet for 4 weekslast report 30 Sep20 articles7 outlets

20 articles from 7 outlets since 25 Feb. Quiet since 30 Sep.

Now25 Feb7111612 May28 Sep6111621First reportCISA · 25 Feb, 17:32Picked up againafter 4 days quiet
  • Wed 25 Feb, 17:32 UTC. CISA, first report. CISA adds CVE-2026-20127 after exploit of Cisco SD WAN auth bypass. Cites a CVE in CISA KEV.
  • Wed 25 Feb, 17:34 UTC. CISA. CISA adds CVE-2026-20127: Cisco SD WAN allows admin takeover. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 00:45 UTC. Rapid7, its first report on the story. CISA orders emergency patch for Cisco SD WAN after CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 06:49 UTC. The Hacker News, its first report on the story. Critical CVE-2026-20127 in Cisco SD WAN gives remote admin access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:52 UTC. SecurityWeek, its first report on the story. Cisco patches exploited Catalyst SD WAN zero day CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:53 UTC. Infosecurity, its first report on the story. Five Eyes warn Cisco SD WAN zero day grants admin CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 12:56 UTC. Security Affairs, its first report on the story. CVE-2026-20127: Critical Cisco SD WAN flaw gives root access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 16:01 UTC. Security Affairs. CISA: CVE-2026-20127 lets attackers gain admin on Cisco SD WAN. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 22:10 UTC. Dark Reading, its first report on the story. Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years. Cites a CVE in CISA KEV.
  • Mon 2 Mar, 14:13 UTC. The Hacker News. Cisco SD WAN CVE-2026-20127 flaw bypasses auth for admin. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 12:29 UTC. SecurityWeek. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 16:41 UTC. The Hacker News. Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN. Cites a CVE in CISA KEV.
  • Sun 8 Mar, 12:49 UTC. SecurityWeek. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks. Cites a CVE in CISA KEV.
  • Thu 12 Mar, 13:09 UTC. Infosecurity. CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws. Cites a CVE in CISA KEV.
  • Fri 13 Mar, 20:15 UTC. Dark Reading. Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos. Cites a CVE in CISA KEV.
  • Thu 14 May, 19:41 UTC. Security Affairs. U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Thu 14 May, 20:51 UTC. Dark Reading. Cisco SD WAN flaw lets attackers seize control, patch urged. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:11 UTC. The Hacker News. CISA warns of Cisco Catalyst SDWAN flaw amid active exploitation. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:41 UTC. SecurityWeek. Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT8616. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 18:38 UTC. Rapid7. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 20 articles as a list
  1. Wed 25 FebDay 02
    1. CISA adds CVE-2026-20127 after exploit of Cisco SD WAN auth bypass17:32 · CISA · official · First report · CISA alert · Known exploited CVE
    2. CISA adds CVE-2026-20127: Cisco SD WAN allows admin takeover17:34 · CISA · official · Known exploited CVE
  2. Thu 26 FebDay 17
    1. CISA orders emergency patch for Cisco SD WAN after CVE-2026-2012700:45 · Rapid7 · Known exploited CVE
    2. Critical CVE-2026-20127 in Cisco SD WAN gives remote admin access06:49 · The Hacker News · Known exploited CVE
    3. Cisco patches exploited Catalyst SD WAN zero day CVE-2026-2012709:52 · SecurityWeek · Known exploited CVE
    Show 4 more from 26 Feb
    1. Five Eyes warn Cisco SD WAN zero day grants admin CVE-2026-2012709:53 · Infosecurity · Known exploited CVE
    2. CVE-2026-20127: Critical Cisco SD WAN flaw gives root access12:56 · Security Affairs · Known exploited CVE
    3. CISA: CVE-2026-20127 lets attackers gain admin on Cisco SD WAN16:01 · Security Affairs · Known exploited CVE
    4. Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years22:10 · Dark Reading · Known exploited CVE

  3. Quiet for 4 days

    Mon 2 MarDay 51
    1. Cisco SD WAN CVE-2026-20127 flaw bypasses auth for admin14:13 · The Hacker News · Picked up again · Known exploited CVE

  4. Quiet for 3 days

    Thu 5 MarDay 82
    1. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns12:29 · SecurityWeek · Picked up again · Known exploited CVE
    2. Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN16:41 · The Hacker News · Known exploited CVE

  5. Quiet for 3 days

    Sun 8 MarDay 111
    1. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks12:49 · SecurityWeek · Picked up again · Known exploited CVE

  6. Quiet for 4 days

    Thu 12 MarDay 151
    1. CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws13:09 · Infosecurity · Picked up again · Known exploited CVE
  7. Fri 13 MarDay 161
    1. Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos20:15 · Dark Reading · Known exploited CVE

  8. Quiet for 9 weeks

    Thu 14 MayDay 782
    1. U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog19:41 · Security Affairs · Picked up again · Known exploited CVE
    2. Cisco SD WAN flaw lets attackers seize control, patch urged20:51 · Dark Reading · Known exploited CVE
  9. Fri 15 MayDay 792
    1. CISA warns of Cisco Catalyst SDWAN flaw amid active exploitation06:11 · The Hacker News · Known exploited CVE
    2. Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT861606:41 · SecurityWeek · Known exploited CVE

  10. Quiet for 20 weeks

    Wed 30 SepDay 2171
    1. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access18:38 · Rapid7 · Picked up again · Known exploited CVE

All CVEs in coverage1

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-20127Exploited

    Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

    10.0Critical89% EPSS · 20 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in