CVE-2026-20129 Cisco Catayst SD-WAN Authentication Bypass Vulnerability

Critical 9.8 Published 25 Feb 2026 Updated 20 Mar 2026

Unauthenticated remote attackers can bypass API authentication to gain netadmin privileges and execute commands on Cisco Catalyst SD-WAN Manager.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-20129?

CVE-2026-20129 is a critical authentication bypass vulnerability in Cisco Catalyst Sd-Wan Manager, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected system as a user who has the netadmin role. The vulnerability is due to improper authentication for requests that are sent to the API. An attacker could exploit this vulnerability by sending a crafted request to the API of an affected system. A successful exploit could allow the attacker to execute commands with the privileges of the netadmin role. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability. 

Weakness: CWE-287

Which versions are affected by CVE-2026-20129?

It affects 1 product.

Products include Cisco Catalyst Sd-Wan Manager.

How do I fix CVE-2026-20129?

No fix has been published for CVE-2026-20129 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-20129 being exploited?

There is no known exploitation of CVE-2026-20129 in the wild and no public exploit code.

All Cisco Catalyst Sd-Wan Manager vulnerabilities

Sources

Also known as GHSA-5h54-2f2f-5x5c.