Cisco has updated its February advisory to say another SD-WAN product, Catalyst SD-WAN Validator, is vulnerable to a maximum-severity flaw that attackers have already used. The issue, CVE-2026-20127, is an improper authentication bug that can let an attacker become an administrator; Cisco previously said it could then be chained with CVE-2022-20775, a path traversal flaw, to gain persistent root access on vulnerable SD-WAN systems.
Why it matters: Organizations using Cisco SD-WAN need to confirm Validator was included in their remediation and review logs for signs of compromise. This matters because affected systems can be fully taken over and used to alter core network settings.
2026.06.17
100% relevant
This article establishes a distinct update to the CVE-2026-20127 story by adding a newly acknowledged affected product, which changes the scope of who must verify patching and hunt for compromise.
← Back to all stories