Summary
Cisco has disclosed CVE-2026-20478, a critical unauthenticated remote code execution vulnerability in Cisco SD-WAN Manager that is being actively exploited in attacks. The vulnerability is rated CVSS 9.6 and allows an unauthenticated attacker to execute arbitrary commands on the SD-WAN Manager server by sending a specially crafted request to its REST API. Successful exploitation gives an attacker full control over the SD-WAN management plane. Cisco has released an emergency patch. This is the fourth major SD-WAN management platform vulnerability disclosed in September 2026.
Timeline
| Date | Event |
|---|---|
| Prior to Sep 29, 2026 | CVE-2026-20478 exploited as zero-day in active attacks against Cisco SD-WAN Manager deployments |
| Sep 29, 2026 | Cisco releases emergency patch; discloses CVE-2026-20478 and confirms active exploitation; BleepingComputer reports |
What Happened
CVE-2026-20478 is an unauthenticated command injection vulnerability in the REST API of Cisco SD-WAN Manager. The API endpoint fails to properly validate input in requests used for device onboarding and status reporting, allowing an attacker to inject operating system commands that execute with the privileges of the SD-WAN Manager process. The REST API is typically reachable from network segments hosting SD-WAN edge devices, which in enterprise deployments often includes internet-facing locations.
Cisco SD-WAN Manager holds the complete network topology, routing policy, security policy, and device credentials for all connected SD-WAN edge devices. Root-equivalent access gives an attacker full visibility into and control over the SD-WAN fabric, the ability to modify routing and firewall policy across all connected devices, and access to all credentials stored in the management platform. September 2026 has now seen critical zero-days confirmed exploited in Arista VeloCloud (CVE-2026-52174), Citrix NetScaler (CVE-2026-62106), F5 BIG-IP APM (CVE-2026-41557), and now Cisco SD-WAN Manager — a concentration of network infrastructure zero-days without recent precedent.
Domain Intelligence
cisco.com — 61.98
cisco.com scores in the low-trust range at 61.98. Cisco is the vendor of the affected SD-WAN Manager product and the party that patched CVE-2026-20478.