Cisco SD-WAN Flaw Was Exploited for Roughly Three Years Before Anyone Had a Patch

Cisco disclosed on February 25, 2026 a maximum-severity authentication bypass in its Catalyst SD-WAN products, CVE-2026-20127, and said attackers had been abusing it since at least 2023. CISA responded with Emergency Directive 26-03, and the Five Eyes agencies published a joint guide for hunting for compromise.

What happened

SD-WAN controllers sit at the heart of a company's wide-area network, deciding how branch offices, data centres and clouds connect. A bug that lets an attacker skip authentication on such a controller hands over a privileged position from which traffic and configurations can be manipulated. Reporting says exploitation predated any fix by roughly three years, which means that patching alone cannot answer whether a network was already compromised.

For that reason the directive goes beyond the usual patch order. It asks federal agencies to inventory affected systems, collect logs and apply updates, in that order, so compromise evidence is preserved. The Five Eyes hunt guide gives defenders in allied governments and industry the same playbook. CISA also added a chained privilege-escalation flaw, CVE-2022-20775, to its Known Exploited Vulnerabilities catalog. It follows an earlier emergency directive over two exploited Cisco ASA and Firepower zero-days, CVE-2025-20333 and CVE-2025-20362.

The second directive: stop running dead hardware

Three weeks earlier, on February 5, CISA issued Binding Operational Directive 26-02, ordering federal civilian agencies to take stock of edge devices that have reached end of support and to decommission them. The first checkpoint was an inventory due three months later, on May 5, 2026. The reasoning is straightforward: firewalls, VPN gateways and routers are internet-facing, rarely run endpoint protection and, when out of support, never get fixes. They have been among the most-exploited categories in recent years.

Why it matters

The episode reinforces two uncomfortable lessons. First, zero-days in network infrastructure can persist for years because these devices are poorly monitored; no one is watching a controller the way they watch a laptop. Second, "patch and move on" is wrong when exploitation predates the fix. Organisations need log retention long enough to look back, and a plan to rebuild credentials and configurations if signs of compromise appear.

One blog gave different directive numbering and dates; the figures used here follow CyberScoop and Nextgov reporting.

Hunting after the patch

When a flaw has been exploited for years, the question for defenders shifts from "are we vulnerable" to "have we been compromised". The joint hunt guidance from the Five Eyes partners is aimed at that question. In general, responders look at authentication logs on the controller for logins that do not match known administrators, review configuration changes and newly added peers or accounts, compare running configurations with trusted baselines, and check for unexpected outbound connections from management systems. Preserving logs before patching is crucial, because an upgrade or reboot can destroy volatile evidence. That is why CISA's directive orders agencies to collect logs before they apply updates.

Edge and network devices are attractive to sophisticated actors for the same reason they are hard to defend. They often run proprietary operating systems that do not support standard endpoint detection tools, they sit at privileged points where all traffic passes, and they are managed by network teams that may not be integrated with the security operations centre. Previous waves of attacks on VPN gateways, firewalls and routers followed the same pattern: quiet exploitation, long dwell time, discovery by a vendor or government rather than the victim.

The earlier emergency directive on Cisco ASA and Firepower, covering CVE-2025-20333 and CVE-2025-20362, and the new SD-WAN case mean that Cisco appliances have drawn repeated federal action in a short period. That does not prove Cisco is uniquely weak; large vendors with wide deployments are simply bigger targets, and the disclosure of previously unknown exploitation tells us more about adversary focus than about product quality.

BOD 26-02 targets a related, solvable problem. Many agencies, and many companies, still run firewalls and routers long after the vendor stops issuing fixes, because replacing them is expensive and disruptive. By setting a deadline for inventories and retirements, CISA is trying to force that budget conversation. The directive covers federal civilian agencies, but its logic applies to any organisation with an unsupported device facing the internet: if it cannot be patched, it should be replaced or isolated.

What to watch

• Findings from the Five Eyes hunt guide, including how many networks show evidence of earlier compromise.
• Agency progress against BOD 26-02 after the May inventory milestone.
• Whether other SD-WAN and firewall vendors disclose similar long-lived flaws as researchers use AI tools to audit appliances.

Sources

1. Cisco zero-days, CISA emergency directive, Five Eyes — CyberScoop
2. CISA orders federal agencies to replace end-of-life edge devices — BleepingComputer
3. CISA orders agencies to patch and replace end-of-life devices, citing active exploitation — Nextgov
4. CISA BOD 26-02 and the Risk of Unsupported Edge Devices — Halo Security