# CVE-2026-20127: Cisco SD-WAN vManage - RCE

> Live exploitation tracking for CVE-2026-20127 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-20127

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Cisco Catalyst SD-WAN Manager
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')); CWE-552 (Files or Directories Accessible to External Parties); CWE-434 (Unrestricted Upload of File with Dangerous Type)
- **Tags:** enterprise_software, management_panel

## Description

A vulnerability in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated, remote attacker to achieve remote code execution on an affected device. The exploit chain involves unauthenticated access to the data collection agent configuration endpoint to obtain a privileged credential, which is then used to upload a malicious WAR file with a path-traversal filename to the smart licensing upload endpoint, deploying a webshell into the WildFly application server deployment directory.

## CrowdSec analysis

[CVE-2026-20127](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-20127) is a critical pre-authentication remote code execution vulnerability in Cisco Catalyst SD-WAN Manager (vManage). The exploit chain begins with unauthenticated retrieval of a data collection agent credential from an exposed configuration endpoint, which is then used to authenticate as a privileged internal service account. The attacker then uploads a malicious WAR file using a path-traversal filename to the smart licensing acknowledgment endpoint, causing the WildFly application server to deploy a JSP webshell, granting full remote code execution on the underlying host.

CrowdSec has been tracking this vulnerability and its exploits since 6th of March 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-20127 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers send a GET request to `/reports/data/opt/data/containers/config/data-collection-agent/.dca` to retrieve the DCA key unauthenticated, then POST to `/jts/authenticated/j_security_check` with username `viptela-reserved-dca` and the stolen key, and finally POST a multipart WAR file with a path-traversal filename to `/dataservice/smartLicensing/uploadAck` to deploy a webshell into the WildFly deployment directory.

## Timeline

- 2026-01-01: CVE Published. CVE-2026-20127 is published to NVD.
- 2026-02-25: CISA KEV. CVE-2026-20127 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-02-27: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-03-06: Rule Released. CrowdSec releases a rule to detect CVE-2026-20127 exploitation attempts against the CrowdSec Network.
- 2026-03-06: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-20127 for the first time.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2026-20127
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
- https://github.com/zerozenxlabs/CVE-2026-20127---Cisco-SD-WAN-Preauth-RCE

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-20127) follows observed exploitation activity for CVE-2026-20127. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.