Research · Feb 25, 2026 · ZeroDay Catalog
Critical Authentication Bypass Vulnerability in Cisco Catalyst SD-WAN Products
A serious authentication bypass vulnerability has been identified in Cisco's Catalyst SD-WAN products, potentially allowing unauthorized administrative access.
What changed
A significant vulnerability has been discovered in the peering authentication mechanism of Cisco Catalyst SD-WAN products. This flaw could enable an unauthenticated remote attacker to bypass authentication protocols, granting them administrative privileges on affected systems.
- The vulnerability is attributed to improper functioning of the peering authentication mechanism.
- Exploitation could occur through crafted requests sent to the affected systems.
- Successful exploitation may lead to unauthorized access and control over the SD-WAN infrastructure.
Who is affected
Organizations utilizing Cisco Catalyst SD-WAN products should be aware of their exposure to this vulnerability. The following products are specifically impacted:
- Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart)
- Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage)
- Cisco Catalyst SD-WAN Validator (formerly SD-WAN vBond)
- Any enterprise relying on these systems for network management and security.
What to do
It is crucial for affected organizations to take immediate action to mitigate the risks associated with this vulnerability. Ensure that all relevant systems are updated and secured.
- Review and apply any available patches or updates from Cisco.
- Implement additional security measures to monitor and restrict access to affected systems.
- Conduct a thorough assessment of your network to identify potential exploitation attempts.
- Stay informed about further updates or advisories from Cisco regarding this vulnerability.