CVE-2026-20127 Splunk · SPL

Detect Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass (CVE-2026-20127) in Splunk

CVE-2026-20127 is an authentication bypass vulnerability (CWE-287) affecting Cisco Catalyst SD-WAN Controller and Manager. A remote, unauthenticated attacker may exploit improper authentication mechanisms to gain unauthorized access to the management plane. This vulnerability is actively exploited in the wild per CISA KEV and is subject to Emergency Directive ED-26-03.

MITRE ATT&CK

Tactic
Initial Access Persistence Credential Access

SPL Detection Query

Splunk (SPL)
spl 
index=network OR index=cisco_sdwan OR index=syslog
(sourcetype="cisco:sdwan" OR sourcetype="cisco:vmanage" OR sourcetype="cisco:ios" OR host IN ("vmanage*", "vbond*", "vsmart*"))
| eval event_time=_time
| search (message IN ("*auth*bypass*", "*unauthenticated*", "*no.*session*", "*unauthorized*access*") OR (status IN ("401", "403", "200") AND uri IN ("/dataservice/*", "/j_security_check", "/rest/*")))
| rex field=_raw "(?<src_ip>\\b(?:[0-9]{1,3}\\.){3}[0-9]{1,3}\\b)"
| rex field=_raw "(?<http_method>GET|POST|PUT|DELETE|PATCH) (?<uri_path>\/[^\\s]+)"
| stats count AS attempt_count, dc(uri_path) AS distinct_paths, values(http_method) AS methods, min(_time) AS first_seen, max(_time) AS last_seen BY src_ip, host
| where attempt_count >= 3
| eval severity=if(attempt_count>=10, "critical", "high")
| eval cve="CVE-2026-20127"
| table _time, src_ip, host, attempt_count, distinct_paths, methods, first_seen, last_seen, severity, cve
critical severity medium confidence

Detects exploitation attempts of CVE-2026-20127 by identifying anomalous unauthenticated or authentication-bypassing requests to Cisco SD-WAN vManage REST API endpoints (/dataservice, /j_security_check), aggregated by source IP to surface brute-force or automated exploit tooling.

Data Sources

Cisco SD-WAN LogsNetwork Proxy LogsSyslog

Required Sourcetypes

cisco:sdwancisco:vmanagecisco:ios

False Positives & Tuning

  • Automated API integration scripts that lack proper session management hitting vManage endpoints
  • Vulnerability scanners generating authentication probe traffic during approved scan windows
  • Misconfigured SD-WAN nodes sending health-check requests without valid session tokens
  • Penetration testing engagements targeting SD-WAN infrastructure with prior authorization

Other platforms for CVE-2026-20127

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated vManage REST API Enumeration

    Expected signal: Network logs showing repeated HTTP GET/POST requests to vManage management IP on port 443 with response codes 401, 403, or 200 from the test host IP across multiple /dataservice/ URI paths

  2. Test 2Authentication Bypass Session Token Harvesting Simulation

    Expected signal: HTTP request to /dataservice/device with custom Cookie header not matching any active session, logged in vManage access log with source IP of test host; response will be 401 or 403 in a patched system, or 200 in a vulnerable one

  3. Test 3vManage Admin Account Creation via Bypass

    Expected signal: vManage audit log entry for POST /dataservice/admin/user with actor IP matching test host; new user 'testbackdoor' visible in GET /dataservice/admin/user response; network logs showing POST request to admin/user endpoint

Last updated: 2026-06-19 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify the source IP(s) generating authentication bypass attempts and determine whether they are internal (lateral movement scenario) or external (internet-exposed vManage exploitation). Cross-reference against known good management hosts and jump servers.
  2. Query vManage audit logs (/dataservice/auditlog) and system logs for any successful sessions established from the suspicious source IP immediately following failed authentication attempts — a 401 followed by a 200 from the same IP within seconds is high-confidence exploitation.
  3. Determine the current patch level of all Cisco Catalyst SD-WAN Controller and Manager nodes by running 'show version' via CLI or checking the vManage Dashboard > Administration > Software Repository. Compare against Cisco's advisory at cisco-sa-sdwan-rpa-EHchtZk.
  4. Check whether the vManage management interface is directly internet-exposed by reviewing firewall ACLs and NAT rules. CISA ED-26-03 mandates immediate network isolation of internet-facing vManage instances.

Containment

  1. Immediately restrict network access to the vManage, vBond, and vSmart management interfaces using perimeter firewall rules to permit only approved administrator source IPs and management jump hosts. Block all other inbound access to TCP 443, 8443, and any other exposed management ports.
  2. If exploitation is confirmed or strongly suspected, isolate the affected SD-WAN controller(s) from the production overlay network by placing them in maintenance mode and routing SD-WAN data plane traffic through unaffected controllers. Initiate an emergency change to reset all vManage admin and API credentials and rotate all API tokens, certificates, and service account secrets.

Evidence Collection

  1. Export the full vManage audit log via the REST API (GET /dataservice/auditlog?startDate=<date>&endDate=<date>) and preserve the raw JSON for forensic analysis. Hash the output for chain of custody.
  2. Capture full packet data (PCAP) from the management network segment for the timeframe of the suspected exploitation using span/mirror ports or network TAPs, focusing on TCP 443/8443 traffic to and from the vManage VIP. Preserve for offline TLS decryption if keys are available.

Escalation Criteria

  • !Escalate to CISO and incident response team immediately if a successful authentication bypass is confirmed (HTTP 200 response to authenticated API endpoint without valid session, or new admin/operator account creation detected in vManage audit logs) — this constitutes confirmed compromise of network control plane infrastructure.
  • !Escalate to Cisco TAC and file a report with CISA (per ED-26-03 requirements) if exploitation results in unauthorized configuration changes to SD-WAN policies, routing tables, or VPN tunnel configurations, as this may indicate threat actor persistence and data exfiltration capability.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >vManage REST API access logs at /var/log/nms/vmanage-server.log and /var/log/nms/vmanage-aaa.log containing timestamps, source IPs, HTTP methods, URIs, and response codes for all management plane requests
  • >vManage audit trail accessible via GET /dataservice/auditlog showing all configuration changes, user logins, and API operations with actor attribution
  • >Network flow records (NetFlow/IPFIX) from the management network segment showing connection patterns to vManage management IP on ports 443/8443 from unexpected source IPs
  • >Linux auth logs (/var/log/auth.log or /var/log/secure) on the vManage host for OS-level authentication events if the bypass also enables SSH or direct OS access

Tuning Guidance

Reduce false positives by maintaining an allowlist of approved vManage administrator source IPs and management jump server CIDRs, and excluding these from alerting. Increase confidence threshold from 3 to 10 attempts per 5-minute window if the environment has legitimate API polling. In environments where vManage is behind a load balancer, correlate on session/cookie identifiers rather than source IP alone. If the SD-WAN deployment uses certificate-based mutual TLS for API access, tune queries to focus on endpoints that do not require mTLS as exploitation likely targets non-mTLS paths.

Hunting Queries

30-day retrospective hunt for source IPs that received both authentication failure (401/403) and success (200) responses from Cisco SD-WAN management APIs in the same hour — a strong indicator of authentication bypass exploitation. Useful for establishing the full timeline of compromise and identifying additional affected hosts.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DeviceProduct has_any ("SD-WAN", "vManage")
| where RequestURL has_any ("/dataservice/", "/j_security_check", "/rest/")
| summarize Sessions = count(), UniqueURIs = dcount(RequestURL), StatusCodes = make_set(EventOutcome) by SourceIP, DestinationIP, bin(TimeGenerated, 1h)
| where array_length(StatusCodes) > 1 and StatusCodes has_any ("401", "403")
| order by Sessions desc
Hunting — SPL
spl 
index=cisco_sdwan OR index=network
sourcetype IN ("cisco:vmanage", "cisco:sdwan")
| rex field=_raw "(?<src_ip>\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b)"
| rex field=_raw "HTTP/\d\.\d\" (?<status_code>\d{3})"
| where uri_path IN ("/dataservice/", "/j_security_check", "/rest/")
| stats values(status_code) AS status_codes, count AS hits, dc(uri_path) AS distinct_paths BY src_ip, host, date_hour
| where mvcount(status_codes) > 1 AND mvfind(status_codes, "^(401|403)$") >= 0
| eval bypass_indicator=if(mvfind(status_codes, "^200$") >= 0 AND mvfind(status_codes, "^(401|403)$") >= 0, "HIGH", "MEDIUM")
| sort - hits

Atomic Red Team Tests

Test 1 Unauthenticated vManage REST API Enumeration
linux

Simulates an attacker probing Cisco vManage REST API endpoints without authentication to identify exploitable paths consistent with CVE-2026-20127 authentication bypass. Tests whether unauthenticated requests to /dataservice/ return data or expose session tokens.

Command

bash 
TARGET_IP="192.168.1.100"; for endpoint in "/dataservice/version" "/dataservice/client/server" "/dataservice/device" "/j_security_check"; do echo "[*] Probing $endpoint"; curl -sk -o /tmp/resp_$(echo $endpoint | tr '/' '_').json -w "HTTP_STATUS:%{http_code}" "https://${TARGET_IP}${endpoint}"; echo; done

Cleanup

bash 
rm -f /tmp/resp_*.json

Expected Telemetry

Network logs showing repeated HTTP GET/POST requests to vManage management IP on port 443 with response codes 401, 403, or 200 from the test host IP across multiple /dataservice/ URI paths

Expected Detection

Alert triggers on >= 3 requests to /dataservice/ endpoints returning 401/403 from the same source IP within a 5-minute window; KQL and SPL queries should both fire within the configured lookback period

Test 2 Authentication Bypass Session Token Harvesting Simulation
linux

Simulates the post-bypass phase where an attacker attempts to harvest or forge a vManage session token after exploiting CVE-2026-20127, by replaying a captured or crafted cookie/token value against authenticated API endpoints.

Command

bash 
TARGET_IP="192.168.1.100"; FAKE_TOKEN="JSESSIONID=AAABBBCCC111222333; Path=/"; curl -sk -H "Cookie: $FAKE_TOKEN" -H "Content-Type: application/json" -w "\nHTTP_STATUS:%{http_code}\n" "https://${TARGET_IP}/dataservice/device" -o /tmp/bypass_test.json; cat /tmp/bypass_test.json

Cleanup

bash 
rm -f /tmp/bypass_test.json

Expected Telemetry

HTTP request to /dataservice/device with custom Cookie header not matching any active session, logged in vManage access log with source IP of test host; response will be 401 or 403 in a patched system, or 200 in a vulnerable one

Expected Detection

Detection fires on unauthenticated or invalid-session request to authenticated API endpoint; in a vulnerable environment, a 200 response triggers the high-confidence EQL sequence rule

Test 3 vManage Admin Account Creation via Bypass
linux

Simulates post-exploitation persistence where an attacker who successfully bypassed authentication creates a new administrator account on the vManage controller. This tests detection of unauthorized account creation following a bypass event.

Command

bash 
TARGET_IP="192.168.1.100"; SESSION_COOKIE="JSESSIONID=TESTTOKEN"; curl -sk -X POST "https://${TARGET_IP}/dataservice/admin/user" -H "Content-Type: application/json" -H "Cookie: $SESSION_COOKIE" -d '{"userName":"testbackdoor","password":"Lab0nly!","group":["netadmin"],"description":"atomic test account"}' -w "\nHTTP_STATUS:%{http_code}\n" -o /tmp/acct_create.json; cat /tmp/acct_create.json

Cleanup

bash 
curl -sk -X DELETE "https://${TARGET_IP}/dataservice/admin/user/testbackdoor" -H "Cookie: $SESSION_COOKIE"; rm -f /tmp/acct_create.json

Expected Telemetry

vManage audit log entry for POST /dataservice/admin/user with actor IP matching test host; new user 'testbackdoor' visible in GET /dataservice/admin/user response; network logs showing POST request to admin/user endpoint

Expected Detection

Threat hunting query surfaces POST to /dataservice/admin/user from non-approved source IP; SIEM alert fires on new admin account creation from IP not in administrator allowlist; in full bypass scenario, the initial 401/200 sequence also triggers the authentication bypass detection

Related Detections

Tactic Hubs

TA0001Initial AccessTA0003PersistenceTA0006Credential Access

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1556Modify Authentication Process

Same Tactic: Initial Access

Popular Detections