Cisco Systems, Inc. is addressing a high-severity zero-day vulnerability in its Catalyst SD-WAN Manager and Controller that allows attackers to gain root access [1, 2, 3].

The flaw is critical because it enables an authentication bypass, allowing unauthorized users to obtain full administrative control over network controllers without a password [4, 5].

Intelligence agencies from the Five Eyes — comprising the U.S., UK, Canada, Australia, and New Zealand — issued an emergency directive ordering the immediate patching of affected systems [5, 6]. This coordinated response follows reports that the vulnerability is being actively exploited in the wild [1, 2, 3].

Cisco has assigned a severity score of 10.0 [4] to one of the authentication-bypass flaws, representing a perfect score on the severity scale. This marks the sixth SD-WAN zero-day disclosed by the company so far in 2026 [4].

There are conflicting reports regarding the specific CVE identifiers associated with the current attacks. BleepingComputer said the exploited zero-day is CVE-2026-20245 [1], while other reports cite CVE-2026-20182 [4] or CVE-2026-20127 [7]. Some data suggests active exploitation of related flaws has been observed since 2023 [7].

The vulnerabilities impact Cisco SD-WAN devices globally [5, 6]. Because the flaws allow for the bypass of security protocols, attackers can move laterally through a network once they gain root access to the controller [1, 4].

“Cisco has assigned a severity score of 10.0 to one of the authentication-bypass flaws.”

The frequency of zero-day vulnerabilities in Cisco's SD-WAN software, totaling six in 2026, suggests a systemic security challenge within the product's architecture. The involvement of the Five Eyes alliance indicates that these flaws are not merely theoretical but are being leveraged by sophisticated actors to target critical infrastructure and government networks. For organizations, this necessitates a shift from periodic updates to a more aggressive, immediate patching posture to prevent total network compromise.