Cisco SD-WAN Zero-Day: How UAT-8616 Hid for Three Years

A Three-Year Intrusion, One Month of Reckoning

On February 25, 2026, Cisco Talos published an advisory confirming that a critical zero-day vulnerability in Cisco Catalyst SD-WAN had been actively exploited since at least 2023 by a sophisticated threat actor it tracks as UAT-8616. The same day, six agencies across the Five Eyes alliance issued a joint advisory, and CISA published Emergency Directive 26-03 ordering federal agencies to act within days.

The vulnerability in question, CVE-2026-20127, carries the maximum possible CVSS score of 10.0. It affects both Cisco Catalyst SD-WAN Controller (formerly vSmart) and SD-WAN Manager (formerly vManage) — the central orchestration components that govern entire enterprise SD-WAN fabrics. A three-year gap between first exploitation and discovery makes this one of the longest-running critical infrastructure compromises in recent memory.

The Vulnerability: Broken Peering Authentication

CVE-2026-20127 is an authentication bypass in the peering authentication mechanism used by Cisco Catalyst SD-WAN control and management components. According to Cisco’s security advisory, the flaw exists because “the peering authentication mechanism in an affected system is not working properly.” An unauthenticated remote attacker can send crafted requests that bypass the expected trust checks between SD-WAN components, gaining access as a high-privileged, non-root user account.

That access is enough to reach the NETCONF interface and manipulate configurations across the entire SD-WAN fabric — including routing policies, segmentation rules, and peer relationships. In a centralized SD-WAN architecture, compromising the controller means potentially influencing every edge device it manages.

The maximum CVSS 10.0 score reflects the convergence of worst-case factors: the attack is network-exploitable, requires no authentication, needs no user interaction, has low complexity, and its impact extends beyond the vulnerable component itself to all managed devices in the fabric.

The Attack Chain: Downgrade, Escalate, Restore

UAT-8616 did not rely on CVE-2026-20127 alone. Cisco Talos confirmed that the threat actor consistently chained it with CVE-2022-20775, a path traversal privilege escalation vulnerability in Cisco SD-WAN software originally disclosed in 2022 with a CVSS score of 7.8.

The attack chain works as follows:

1. CVE-2026-20127 — Bypass authentication on the SD-WAN Controller/Manager, gaining high-privileged non-root access
2. Software version downgrade — Use the built-in update mechanism to deliberately downgrade the controller software to a version vulnerable to CVE-2022-20775
3. CVE-2022-20775 — Exploit the path traversal flaw to escalate from the SD-WAN application context to full root-level access on the underlying operating system
4. Version restoration — Restore the original software version to obscure evidence of the downgrade and exploitation

This chain is notable for its anti-forensic sophistication. By restoring the software version after exploitation, UAT-8616 eliminated one of the most obvious indicators of compromise — a software version mismatch — making detection significantly harder.

The Threat Actor: UAT-8616

Cisco Talos assesses “with high confidence” that UAT-8616 is a highly sophisticated cyber threat actor. The advisory does not formally attribute the campaign to a specific nation-state, but the operational characteristics — long dwell time, focus on critical infrastructure, collection-oriented rather than destructive objectives — are consistent with state-sponsored espionage.

Evidence indicates the campaign dates back to at least 2023, giving UAT-8616 approximately three years of access before discovery. The threat actor targeted critical infrastructure sectors, leveraging root-level access to gain visibility into encrypted network traffic and corporate communications flowing through compromised SD-WAN environments.

The campaign aligns with a broader trend of sophisticated actors targeting network edge devices. In 2024, the Volt Typhoon campaign demonstrated similar tactics, exploiting vulnerabilities in Fortinet, Ivanti, and Cisco devices to pre-position in critical infrastructure networks. Network devices remain attractive targets because they sit at the boundary between trusted and untrusted networks, handle all organizational traffic, and receive far less security monitoring than endpoints or cloud workloads.

CISA Emergency Directive 26-03

CISA’s Emergency Directive 26-03, published February 25, 2026, imposed aggressive staged deadlines on all Federal Civilian Executive Branch (FCEB) agencies:

• February 26, 2026 — Inventory all Cisco SD-WAN systems and report to CISA
• February 27, 2026 (5:00 PM ET) — Apply Cisco-provided patches to all affected systems
• March 23, 2026 — Provide all SD-WAN device syslog data to CISA’s Cloud Logging Aggregation Warehouse (CLAW)

The two-day patching deadline is among the most compressed CISA has ever mandated. For context, most Emergency Directives allow one to two weeks for full remediation. A supplemental direction was also issued with hunt and hardening guidance.

The joint advisory from six Five Eyes agencies — CISA, NSA, NCSC (UK), ASD/ACSC (Australia), CCCS (Canada), and NCSC-NZ — provided detailed indicators of compromise, detection guidance, and recommended mitigations. Australian cybersecurity authorities are credited with the initial identification that led to the coordinated disclosure.

Why Three Years Undetected?

The three-year dwell time exposes structural weaknesses in how organizations monitor network infrastructure.

Network devices are a detection blind spot. Enterprise security has invested heavily in endpoint detection and response (EDR) for servers and workstations, and cloud security posture management (CSPM) for cloud environments. But network devices — routers, SD-WAN controllers, firewalls — run proprietary operating systems with limited support for third-party security agents. Their logs record configuration events, not the process-level telemetry that EDR relies on.

SD-WAN complexity masks malicious changes. SD-WAN platforms involve centralized orchestration, distributed edge devices, encrypted tunnels, and frequent configuration changes driven by performance requirements. Malicious configuration modifications blend seamlessly with the high volume of legitimate operational changes that occur daily in a large SD-WAN deployment.

Slow patching of network infrastructure. CVE-2022-20775 was disclosed in 2022, yet many organizations had not patched it by 2023 when UAT-8616 began chaining it with the zero-day. Firmware updates for network devices require maintenance windows, regression testing, staged rollouts, and sometimes physical access — a process that can take weeks or months. By 2026, Gartner projects that 70% of enterprises will have implemented SD-WAN, making the patching challenge an industry-scale concern.

Management plane exposure. SD-WAN controllers must communicate with distributed edge devices, creating pressure to make management interfaces accessible over the network. Organizations that expose SD-WAN management planes to the internet — whether intentionally for remote administration or inadvertently through misconfigured access controls — provide the network path attackers need.

Hardening Recommendations

The campaign reinforces the need to extend zero-trust principles to network infrastructure:

• Isolate the management plane. SD-WAN Controller and Manager interfaces should be accessible only from dedicated management networks, never from the internet or general-purpose enterprise segments.
• Enforce layered authentication. Even if application-level authentication is bypassed, network-level access controls and multi-factor authentication at the management boundary can limit exposure.
• Monitor configuration drift. Deploy automated tools that continuously compare running configurations against known-good baselines and alert on unauthorized changes to device templates and policies.
• Accelerate network device patching. Establish a regular firmware update cadence, even if it requires scheduled maintenance windows. The CVE-2022-20775 chain demonstrates that unpatched “known” vulnerabilities become force multipliers for zero-days.
• Hunt proactively. Conduct periodic threat hunts specifically focused on network infrastructure using the indicators of compromise published in the Five Eyes advisory and CISA’s supplemental guidance.

Sources & Further Reading

• Active Exploitation of Cisco Catalyst SD-WAN by UAT-8616 — Cisco Talos Intelligence
• ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems — CISA
• Cisco Security Advisory: Catalyst SD-WAN Controller Authentication Bypass — Cisco PSIRT
• CISA and Partners Release Guidance for Ongoing Global Exploitation of Cisco SD-WAN Systems — CISA
• Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited Since 2023 — The Hacker News
• Five Eyes Urge Action as Cisco Zero-Day Attacks Uncovered — The Register
• CVE-2022-20775: Cisco SD-WAN Privilege Escalation — NVD
• Joint Advisory on Exploitation of SD-WAN Appliances — NSA/DoD