Why APT Groups Attack SD-WAN Controllers
The Cisco Catalyst SD-WAN Manager (formerly vManage) is the only control point of the entire SD-WAN factory. It centrally rolls up configurations on edge devices on Cisco IOS XE, sets routing policies through SD-WAN Controller (vSmart) and orchestras authentication via SD-WAN Validator (vBond). The attacker, which has gained control of vManage, manages all corporate WAN infrastructure: routes, ACL, VPN tunnels and DNS settings on every branch router. One node is the whole factory.
For APT campaigns, vManage is the goal with a maximum return: the compromising one control unit opens the configuration of hundreds of edge-devices without having to break each separately. With the extension of SD-WAN as a transport for 5G-connected affiliates, the vulnerability in controllers is hit by much wider infrastructure. According to the IBM X-Force Thread Intelligence Index 2025, the average time between the publication of CVE and the elimination of 29 months in the organization. For SD-WAN, this delay means that the attacker can not just gain a foothold, but reconfigure the entire factory while the organization is waiting for windows to update.
The place of attack in kill chain: from Resource Development - Network Devices (T1584.008) through Initial Access - Exploit Public-Facting Application (T1190) until the control system is fully controlled with the ability to flutter the configurations for the entire WAN-segment.
Two authentication bypass with CVSS 10.0: Cisco SD-WAN critical vulnerability
CVE-2026-20127: bypassing the authentication of peering
The vulnerability in the peering authentication mechanism affects all three control components: SD-WAN Controller, Manager and Validator. Incorrect piering authentication allows an uncertified remote attacker to circumvent the authentication and obtain administrative privileges.
• CVSS: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- attack over the network, no privileges, without user interaction, Changed Scope
• CWE: CWE-287 (Impropper Authentication) (OWASP Authentication)
• EPSS: 0.5779 (Top 5%)
• CISA KEV: added February 25, 2026 deadline, elimination - February 27 (two days). SSVC Decision: Act, Automated yes:
The operation gives the attacker input to the SD-WAN Controller as an internal privileged user (not root, but with access to NETCONF) - and this is a manipulation of the network configuration of the entire factory. According to industry sources, the activity in this CVE is supposedly associated with the cluster UAT-8616.
CVE-2026-20182: second bypass in the same service
Discovered by Rapid7 researchers in investigation CVE-2026-20127. This is not a patch bypass of the previous vulnerability, but a separate problem in the same area of the network stack - the service vdaemon through DTLS, but in the handshake procedure of control connections (Cybersecurity Dive).
• CVSS: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• CWE: CWE-287 - OWASP A07 (Identification and Authentication Failures)
• EPSS: 0.8769 (Top 1% - extremely high exposure probability)
• CISA KEV: added on May 14, 2026. SSVC Decision: Act, Automated yes:
Cisco observed the operation of this SD-WAN vManage vulnerability as zero-day in May 2026. CISA has released the Emergency Directive 26-03 with demands for hunt and hardening, an unprecedented level of response to vulnerabilities in the WAN infrastructure. Both CVE are a key link of initial access in the UAT-8616 chain: administrative access to vManage without any accounting data. Funny against the background of the CrowdStrike Global Threat Report 2025, where 75% of the intrusions require rolling credit - here the attacker does not need them at all.
CVE-2026-20133 and CVE-2026-20255: from key leakage to root
CVE-2026-20133: Vmanage-admin key disclosure
The third actively exploited vulnerability in the CISA KEV chronology (added on April 20, 2026).
• CVSS: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- requires low privileges, privacy exposure (High)
• CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
• EPSS: 0.1024 (Top 5%)
• SSVC: Attend, Exploitation: active
Insufficient restrictions of the file system allow an authenticated attacker with privileges netadmin read sensitive data at the OS level via vshell. According to SecurityLab/itsec.ru, VulnCheck researchers have collected a working exploit: extracting a private key of the user vmanage-admin and secession of control over the NETCONF-protocol. This is an alternative route for the lateral movement – even with low-level access, the attacker escalates it before the configuration management.
CVE-2026-20245: from netadmin to root via CLI
If the authentication bypass gives administrative access at the application level, the CVE-2026-2045 converts it into full control of the OS. CVSS 7.8 (High, not Critical) - the correct name here is fundamental, because previous reports mistakenly called it critical.
• CVSS: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- local vector, low privileges, full impact on CIA
• CWE: CWE-116 (Improper Encoding or Escaping of Output)
• EPSS: 0.2532 (Top 5%)
• CISA KEV: added June 9, 2026. SSVC Decision: Act - patch immediately
• Workaround: None
Vulnerability sits in the team tenant-upload CLI SD-WAN Manager. The function is designed to massively load the tenant configurations via the CSV file, but the input validation is so weak that it allows you to implement shell commands directly in the CSV. They are performed with root privileges.
Formally, the attack vector is local (AV:L). In practice, SD-WAN Manager is available through SSH and web interface, which in many deloyments are open to broad administrative subnets. Cisco SD-WAN Hardening Guide explicitly warns against such a configuration – but who reads it before the incident? In the observed case, the attacker received CLI-access through pre-operating CVE-2026-20127 or CVE-2026-20182Turning by turning CVE-2026-20245 from local escalation to network root-compromising.
According to the researchers, pre-disclosure operation of this vulnerability presumably began no later than March 2026 - a few months before the publication of the patch.
Full UAT-8616 attack chain on SD-WAN infrastructure
Based on publications of industry researchers and analysis of open sources - reconstruction:
Phase 1 - Initial Access (late 2025 - early 2026). The attacker installed unauthorized peer-to-peer connections to the SD-WAN Manager through CVE-2026-20127 or CVE-2026-20182. The compounds gave the visibility of the target environment and the extraction of the certificate material. ATT&CK: Exploit Public-Facting ApplicationT1190, Initial Access), Network Device Authentication (T1556.004, Persistence / Defense Implay)
Phase 2 - Fixation (March 2026). Authentication through SSH as vmanage-admin. Change of default account password admin - Mandiant assesses this as a deliberate blocking of defenders. Rude, but effectively: while the SOC is trying to lie down, attacking itself inside. ATT&CK: Valid Accounts (T1078, Persistence)
Phase 3 - Privilege Escalation (March 2026). Download malicious CSV and escalation to root:
Bash:
request tenant-upload tenant-list /home/admin/evil_tenant.csv vpn 0
Payload in CSV added a record in /etc/passwd and /etc/shadow, creating an account troot with UID 0 and preset password hash. Before the execution, the attacker copied the original files in hidden directories - backup-and-restore as anti-forensic technology.
Phase 4 - Anti-Forensics. After receiving root through su troot and the execution of targeted actions, the attacker restored the original /etc/passwd and /etc/shadow, launched verification scripts to confirm the removal of evidence. Modified files existed only in transit - passive log collection would not record an injection of the account. ATT&CK: Patch Image (T1601.001, Defense Impassment)
Phase 5 - Impact on the factory. Cisco confirmed “limited cases where exploitation has led to a change in the configuration sent to edge devices.” Root access to vManage - the ability to flute arbitrary configurations on all network equipment. ATT&CK: Network Device Configuration Dump (T1602.002, Collection)
ATT&CK Summary by Chain
Three vManage vulnerabilities without confirmed operation
In addition to the four CVE from the CISA KEV catalog, Cisco revealed three more vulnerabilities in the SD-WAN Manager in the same period. Active operation on them is not recorded, but with a stable interest of APT to vManage - to ignore them is more expensive.
CVE-2026-20224 - XXE injection (CVSS 8.6, High). Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - without authentication, reading arbitrary files through incorrect XML-essement processing. CWE-20 (Improper Input Validation), OWASP A05 category (Security Missviguration) EPSS 0.0070 is still below the median, but the vector without privilege makes it dangerous on the display web UI.
CVE-2026-20209 and CVE-2026-20210 - Privileges escalation (CVSS 5.4, Medium each). CWE-779 (Logging of Excessive Data) CVE-2026-20209 - sensitive session information is written in audit logs without editing. CVE-2026-200210 - sensitive data are not edited in device configurations and templates, which allows you to modify configurations. Both give the user with read-only the promotion rights to high-privileged. OWASP A07 (Identification and Authentication Failures) - leakage of authentication data through excessive logging. These CVE are not dependent on each other and are not a precondition for the UAT-8616 chain, but extend the attack surface to the same component. Putting at the same time as the main ones.
Detachment and immediate response checklist
SD-WAN Compromise Indicators
Unauthorized peer-to-pear compounds. In logs vSmart looking for records control-connection-state-change c peer-type:vmanage:
Code:
vSmart-01 VDAEMON_0[2571]: control-connection-state-change new-state:up peer-type:vmanage peer-system-ip:1.1.1.10 public-ip:192.168.3.20
For each record, we divide: peer-system-ip coincides with the known address; public-ip - the expected source of the pyring; the timestamp coincides with the planned events. Any discrepancy is a reason to dig further.
SSH-automatic vmanage-admin. V /var/log/auth.log Looking Accepted publickey for vmanage-admin from IP addresses not available in the System IP list (WebUI > Devices > System IP). Coincidence is an indicator of unauthorized access.
Modification of system files. Check /etc/passwd accounts with UID 0, different from root. We check the presence of hidden copies of system files in non-standard directories. If found, you have a bigger problem than a unpatept vManage.
The Cisco Catalyst SD-WAN Manager (formerly vManage) is the only control point of the entire SD-WAN factory. It centrally rolls up configurations on edge devices on Cisco IOS XE, sets routing policies through SD-WAN Controller (vSmart) and orchestras authentication via SD-WAN Validator (vBond). The attacker, which has gained control of vManage, manages all corporate WAN infrastructure: routes, ACL, VPN tunnels and DNS settings on every branch router. One node is the whole factory.
For APT campaigns, vManage is the goal with a maximum return: the compromising one control unit opens the configuration of hundreds of edge-devices without having to break each separately. With the extension of SD-WAN as a transport for 5G-connected affiliates, the vulnerability in controllers is hit by much wider infrastructure. According to the IBM X-Force Thread Intelligence Index 2025, the average time between the publication of CVE and the elimination of 29 months in the organization. For SD-WAN, this delay means that the attacker can not just gain a foothold, but reconfigure the entire factory while the organization is waiting for windows to update.
The place of attack in kill chain: from Resource Development - Network Devices (T1584.008) through Initial Access - Exploit Public-Facting Application (T1190) until the control system is fully controlled with the ability to flutter the configurations for the entire WAN-segment.
Two authentication bypass with CVSS 10.0: Cisco SD-WAN critical vulnerability
CVE-2026-20127: bypassing the authentication of peering
The vulnerability in the peering authentication mechanism affects all three control components: SD-WAN Controller, Manager and Validator. Incorrect piering authentication allows an uncertified remote attacker to circumvent the authentication and obtain administrative privileges.
• CVSS: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- attack over the network, no privileges, without user interaction, Changed Scope
• CWE: CWE-287 (Impropper Authentication) (OWASP Authentication)
• EPSS: 0.5779 (Top 5%)
• CISA KEV: added February 25, 2026 deadline, elimination - February 27 (two days). SSVC Decision: Act, Automated yes:
The operation gives the attacker input to the SD-WAN Controller as an internal privileged user (not root, but with access to NETCONF) - and this is a manipulation of the network configuration of the entire factory. According to industry sources, the activity in this CVE is supposedly associated with the cluster UAT-8616.
CVE-2026-20182: second bypass in the same service
Discovered by Rapid7 researchers in investigation CVE-2026-20127. This is not a patch bypass of the previous vulnerability, but a separate problem in the same area of the network stack - the service vdaemon through DTLS, but in the handshake procedure of control connections (Cybersecurity Dive).
• CVSS: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• CWE: CWE-287 - OWASP A07 (Identification and Authentication Failures)
• EPSS: 0.8769 (Top 1% - extremely high exposure probability)
• CISA KEV: added on May 14, 2026. SSVC Decision: Act, Automated yes:
Cisco observed the operation of this SD-WAN vManage vulnerability as zero-day in May 2026. CISA has released the Emergency Directive 26-03 with demands for hunt and hardening, an unprecedented level of response to vulnerabilities in the WAN infrastructure. Both CVE are a key link of initial access in the UAT-8616 chain: administrative access to vManage without any accounting data. Funny against the background of the CrowdStrike Global Threat Report 2025, where 75% of the intrusions require rolling credit - here the attacker does not need them at all.
CVE-2026-20133 and CVE-2026-20255: from key leakage to root
CVE-2026-20133: Vmanage-admin key disclosure
The third actively exploited vulnerability in the CISA KEV chronology (added on April 20, 2026).
• CVSS: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- requires low privileges, privacy exposure (High)
• CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
• EPSS: 0.1024 (Top 5%)
• SSVC: Attend, Exploitation: active
Insufficient restrictions of the file system allow an authenticated attacker with privileges netadmin read sensitive data at the OS level via vshell. According to SecurityLab/itsec.ru, VulnCheck researchers have collected a working exploit: extracting a private key of the user vmanage-admin and secession of control over the NETCONF-protocol. This is an alternative route for the lateral movement – even with low-level access, the attacker escalates it before the configuration management.
CVE-2026-20245: from netadmin to root via CLI
If the authentication bypass gives administrative access at the application level, the CVE-2026-2045 converts it into full control of the OS. CVSS 7.8 (High, not Critical) - the correct name here is fundamental, because previous reports mistakenly called it critical.
• CVSS: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- local vector, low privileges, full impact on CIA
• CWE: CWE-116 (Improper Encoding or Escaping of Output)
• EPSS: 0.2532 (Top 5%)
• CISA KEV: added June 9, 2026. SSVC Decision: Act - patch immediately
• Workaround: None
Vulnerability sits in the team tenant-upload CLI SD-WAN Manager. The function is designed to massively load the tenant configurations via the CSV file, but the input validation is so weak that it allows you to implement shell commands directly in the CSV. They are performed with root privileges.
Formally, the attack vector is local (AV:L). In practice, SD-WAN Manager is available through SSH and web interface, which in many deloyments are open to broad administrative subnets. Cisco SD-WAN Hardening Guide explicitly warns against such a configuration – but who reads it before the incident? In the observed case, the attacker received CLI-access through pre-operating CVE-2026-20127 or CVE-2026-20182Turning by turning CVE-2026-20245 from local escalation to network root-compromising.
According to the researchers, pre-disclosure operation of this vulnerability presumably began no later than March 2026 - a few months before the publication of the patch.
Full UAT-8616 attack chain on SD-WAN infrastructure
Based on publications of industry researchers and analysis of open sources - reconstruction:
Phase 1 - Initial Access (late 2025 - early 2026). The attacker installed unauthorized peer-to-peer connections to the SD-WAN Manager through CVE-2026-20127 or CVE-2026-20182. The compounds gave the visibility of the target environment and the extraction of the certificate material. ATT&CK: Exploit Public-Facting ApplicationT1190, Initial Access), Network Device Authentication (T1556.004, Persistence / Defense Implay)
Phase 2 - Fixation (March 2026). Authentication through SSH as vmanage-admin. Change of default account password admin - Mandiant assesses this as a deliberate blocking of defenders. Rude, but effectively: while the SOC is trying to lie down, attacking itself inside. ATT&CK: Valid Accounts (T1078, Persistence)
Phase 3 - Privilege Escalation (March 2026). Download malicious CSV and escalation to root:
Bash:
request tenant-upload tenant-list /home/admin/evil_tenant.csv vpn 0
Payload in CSV added a record in /etc/passwd and /etc/shadow, creating an account troot with UID 0 and preset password hash. Before the execution, the attacker copied the original files in hidden directories - backup-and-restore as anti-forensic technology.
Phase 4 - Anti-Forensics. After receiving root through su troot and the execution of targeted actions, the attacker restored the original /etc/passwd and /etc/shadow, launched verification scripts to confirm the removal of evidence. Modified files existed only in transit - passive log collection would not record an injection of the account. ATT&CK: Patch Image (T1601.001, Defense Impassment)
Phase 5 - Impact on the factory. Cisco confirmed “limited cases where exploitation has led to a change in the configuration sent to edge devices.” Root access to vManage - the ability to flute arbitrary configurations on all network equipment. ATT&CK: Network Device Configuration Dump (T1602.002, Collection)
ATT&CK Summary by Chain
Three vManage vulnerabilities without confirmed operation
In addition to the four CVE from the CISA KEV catalog, Cisco revealed three more vulnerabilities in the SD-WAN Manager in the same period. Active operation on them is not recorded, but with a stable interest of APT to vManage - to ignore them is more expensive.
CVE-2026-20224 - XXE injection (CVSS 8.6, High). Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - without authentication, reading arbitrary files through incorrect XML-essement processing. CWE-20 (Improper Input Validation), OWASP A05 category (Security Missviguration) EPSS 0.0070 is still below the median, but the vector without privilege makes it dangerous on the display web UI.
CVE-2026-20209 and CVE-2026-20210 - Privileges escalation (CVSS 5.4, Medium each). CWE-779 (Logging of Excessive Data) CVE-2026-20209 - sensitive session information is written in audit logs without editing. CVE-2026-200210 - sensitive data are not edited in device configurations and templates, which allows you to modify configurations. Both give the user with read-only the promotion rights to high-privileged. OWASP A07 (Identification and Authentication Failures) - leakage of authentication data through excessive logging. These CVE are not dependent on each other and are not a precondition for the UAT-8616 chain, but extend the attack surface to the same component. Putting at the same time as the main ones.
Detachment and immediate response checklist
SD-WAN Compromise Indicators
Unauthorized peer-to-pear compounds. In logs vSmart looking for records control-connection-state-change c peer-type:vmanage:
Code:
vSmart-01 VDAEMON_0[2571]: control-connection-state-change new-state:up peer-type:vmanage peer-system-ip:1.1.1.10 public-ip:192.168.3.20
For each record, we divide: peer-system-ip coincides with the known address; public-ip - the expected source of the pyring; the timestamp coincides with the planned events. Any discrepancy is a reason to dig further.
SSH-automatic vmanage-admin. V /var/log/auth.log Looking Accepted publickey for vmanage-admin from IP addresses not available in the System IP list (WebUI > Devices > System IP). Coincidence is an indicator of unauthorized access.
Modification of system files. Check /etc/passwd accounts with UID 0, different from root. We check the presence of hidden copies of system files in non-standard directories. If found, you have a bigger problem than a unpatept vManage.
