Countries across the Five Eyes alliance have flagged Cisco SD-WAN controllers as under threat from an attack campaign focusing on federal networks.

Cisco's Talos security research unit revealed the threat this week, highlighting a vulnerability in Cisco Catalyst SD-WAN Controller that enables an unauthenticated remote attacker to gain administrative privileges on the affected system by sending a specially crafted request that bypasses authentication. Upon successful exploitation, the attacker obtains administrative privileges on the controller by accessing it as an internal, high-privilege, non-root user account.

Tracked as CVE-2026-20127, Talos associated the remote control execution (RCE) threat with hacking group UAT-8616, with exploitation dating back to 2023. Researchers did not specifically align UAT-8616 with any particular nation states in its advisory blog.

“After the discovery of active exploitation of the zero-day in the wild, we were able to find evidence that the malicious activity went back at least three years,” Talos wrote. “Investigation conducted by intelligence partners identified that the actor likely escalated to root user via a software version downgrade.”

According to Cisco, the actor then exploited a previously known flaw (CVE-2022-20775), before reverting to the original software version, effectively granting them root access.

Joint guidance from the U.S., U.K., Canada, Australia, and New Zealand warned of the threat to government agencies using the affected software, with The Cybersecurity and Infrastructure Security Agency (CISA) warning the “vulnerabilities pose an unacceptable risk to Federal Civilian Executive Branch (FCEB) agencies” in America, and require immediate action.

That action entails an inventory of all in-scope Cisco SD-WAN systems, collecting artifacts such as virtual snapshots and logs of said systems, locating evidence of compromise, and implementing patches and guidance from Cisco. Users on any iteration of Catalyst earlier than version 20.9 were recommended to move to a supported fixed release.

"Based on collaboration with international partners and CISA’s forensic analysis, the ease with which these vulnerabilities can be exploited demands immediate action from all federal agencies," CISA acting Director Madhu Gottumukkala explained. "We urge all entities to implement the measures outlined in this Emergency Directive without delay."

With the Catalyst breach, Cisco has once again found itself at the center of government attention. Last October, the network giant saw pressure from the U.S. government over another RCE-based exploit, this one in its firewall offerings that may have allowed for a nation state-backed breach. The threat saw U.S. Senator Bill Cassidy (R-Louisiana) demand Cisco CEO Chuck Robbins identify any specific threats to individual customers, alongside details of its communication plan with customers, including federal agencies.