INCIDENT REPORT · CP-2026-002

Cisco Catalyst SD-WAN zero-day exploitation and CISA ED 26-03

L3 · ELEVATEDCONFIRMED

Cisco Talos disclosed long-running exploitation of a maximum-severity Catalyst SD-WAN authentication bypass, prompting a Five Eyes joint alert and CISA Emergency Directive 26-03.

Incident ID: CP-2026-002
Disclosure date: 25 FEB 2026
Detection date: Not publicly documented
Affected countries: United States, United Kingdom, Australia, Canada, New Zealand
Plotted location: Washington, D.C., United States (Representative affected organizations (U.S. federal networks); exploitation was global)
Threat classification: Level 3 — ELEVATED
Classification rationale: Multi-year exploitation of core network infrastructure prompting a Five Eyes alert and federal emergency directive.
Attack type: Vulnerability Exploitation
Nature: Malicious activity
Attack vector: Exploitation of CVE-2026-20127 (CVSS 10.0 authentication bypass in Catalyst SD-WAN Controller), followed by software downgrade and CVE-2022-20775 to gain root
Sectors: Government, Telecommunications, Technology
Critical infrastructure: Yes
Organizations affected: Cisco Catalyst SD-WAN customers, U.S. federal civilian agencies
Operational consequences: CISA ordered federal agencies to inventory, patch, hunt for compromise and harden SD-WAN systems within days; reporting indicated exploitation dated back to 2023 and reached federal networks.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Tracked by Cisco Talos as UAT-8616; no nation-state attribution published by Talos

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Cisco Catalyst SD-WAN zero-day exploitation and CISA ED 26-03

L3 · ELEVATEDCONFIRMED

Cisco Talos disclosed long-running exploitation of a maximum-severity Catalyst SD-WAN authentication bypass, prompting a Five Eyes joint alert and CISA Emergency Directive 26-03.

Incident ID

CP-2026-002

Disclosure date

25 FEB 2026

Detection date

Not publicly documented

Affected countries

United States, United Kingdom, Australia, Canada, New Zealand

Plotted location

Washington, D.C., United States (Representative affected organizations (U.S. federal networks); exploitation was global)

Threat classification

Level 3 — ELEVATED

Classification rationale

Multi-year exploitation of core network infrastructure prompting a Five Eyes alert and federal emergency directive.

Attack type

Vulnerability Exploitation

Nature

Malicious activity

Attack vector

Exploitation of CVE-2026-20127 (CVSS 10.0 authentication bypass in Catalyst SD-WAN Controller), followed by software downgrade and CVE-2022-20775 to gain root

Sectors

Government, Telecommunications, Technology

Critical infrastructure

Yes

Organizations affected

Cisco Catalyst SD-WAN customers, U.S. federal civilian agencies

Operational consequences

CISA ordered federal agencies to inventory, patch, hunt for compromise and harden SD-WAN systems within days; reporting indicated exploitation dated back to 2023 and reached federal networks.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Tracked by Cisco Talos as UAT-8616; no nation-state attribution published by Talos