CVE-2026-20127 Cisco SD-WAN Rogue Device Peering Auth Bypass

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•7

Detects potential exploitation of CVE-2026-20127 on SD-WAN controllers, specifically unauthorized SSH authentication to the vmanage-admin account followed by suspicious NETCONF activity, usage of unauthorized tenant list CSV files, or execution of suspicious tenant-upload scripts.