CVE-2026-20127
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-287
Autenticación incorrecta
Fecha de publicación:
25/02/2026
Última modificación:
25/02/2026
Descripción
*** Pendiente de traducción *** A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.<br />
<br />
This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root&nbsp;user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.&nbsp;
Impacto
Puntuación base 3.x
10.00
Gravedad 3.x
CRÍTICA