CISA Emergency Directive 26-03 — Cisco SD-WAN Systems Under Active Exploitation

Threat Summary

Category: Federal Network Security Directive
Features: Active exploitation, authentication bypass, root-level privilege escalation, mandatory forensic collection, emergency compliance deadlines
Delivery Method: Remote exploitation of Cisco SD-WAN management infrastructure
Threat Actor: Unattributed cyber threat actor exploiting publicly disclosed vulnerabilities

---

The Cybersecurity and Infrastructure Security Agency (CISA) has issued Emergency Directive (ED) 26-03 requiring immediate action across all Federal Civilian Executive Branch (FCEB) agencies following confirmed exploitation of Cisco Software-Defined Wide-Area Networking (SD-WAN) systems.

The directive is authorized under 44 U.S.C. § 3553(h), granting the Secretary of Homeland Security — and by delegation the Director of CISA — authority to compel federal agencies to take immediate protective action when a substantial threat to agency information systems is identified. Compliance is mandatory for all FCEB agencies.

CISA has determined that exploitation of Cisco Catalyst SD-WAN Manager (formerly vManage) and Cisco Catalyst SD-WAN Controller (formerly vSmart) presents an imminent threat to federal networks.

Two known exploited vulnerabilities are central to this directive:

CVE-2026-20127 — Authentication bypass enabling an unauthenticated remote attacker to obtain administrative privileges.
CVE-2022-20775 — Path traversal vulnerability enabling authenticated local attackers to escalate privileges and execute arbitrary commands as root.

The combination of authentication bypass and privilege escalation creates a full-chain compromise pathway: remote access → administrative takeover → root-level persistence.

CISA assessed that this condition presents unacceptable risk to federal infrastructure and issued mandatory mitigation timelines measured in hours — not weeks.

---

Infrastructure at Risk

Cisco SD-WAN infrastructure forms the control plane for distributed federal networking environments. These systems:

• Manage encrypted site-to-site connectivity
• Orchestrate routing policy across agency networks
• Interface with cloud infrastructure
• Control edge device configurations

Compromise of SD-WAN management nodes does not remain isolated. It cascades.

An attacker with vManage or vSmart control can:

• Modify routing policies
• Inject malicious configurations
• Establish persistence across edge devices
• Intercept traffic flows
• Deploy secondary payloads
• Pivot laterally across agency infrastructure

This is not endpoint exploitation. It is network command-layer exploitation.

---

Legal Authority & Scope

The directive applies to all FCEB systems — including those hosted by third parties on behalf of agencies. It does not apply to national security systems or intelligence community systems as defined by statute.

Contractors are not directly bound by the directive. Agencies, however, are responsible for enforcing compliance through contractual modification if required.

---

Required Actions (Mandatory Order of Execution)

1. Identify

Agencies must inventory all in-scope Cisco SD-WAN systems and submit to CISA by 11:59 PM ET on February 26, 2026.

2. Collect

By the same deadline, agencies must:

• Configure SD-WAN systems to store logs externally
• Centralize logging for detection and response
• Collect admin core dumps
• Capture portions of /opt and /var directories
• Collect /home directory data
• Export syslogs
• Obtain forensic snapshots of disk and memory
• Collect associated network device logs

Cloud deployments require coordination with Cisco for forensic snapshots and AWS network logs.

This is not patch-and-move-on guidance. It is forensic preservation.

3. Update

After identification and collection, agencies must apply Cisco-provided patches addressing the listed CVEs by 5:00 PM ET February 27, 2026.

4. Hunt

Agencies must conduct compromise assessment per CISA’s supplemental hunt guidance.

If root compromise is identified:

• Immediately notify CISA
• Deploy fresh vManage, vSmart, and vBond instances from patched images
• Migrate edge devices to rebuilt infrastructure

5. Harden

Agencies must follow CISA’s hardening procedures to reduce exposure and persistence pathways.

6. Report

Multiple reporting deadlines extend through March 12, 2026, including inventory submission, mitigation confirmation, and hardening documentation.

---

Exploit Prerequisites

CVE-2026-20127: Pre-auth remote exploitation
CVE-2022-20775: Authenticated local exploitation

Exposure risk increases significantly if SD-WAN management interfaces are internet-facing or weakly segmented.

---

Policy / Allied Pressure

Emergency directives at this level signal cross-agency concern. CISA will provide a consolidated compliance report to:

• The Secretary of Homeland Security
• The National Cyber Director
• The Office of Management and Budget

Deadline for that report: May 1, 2026.

This elevates the issue beyond technical remediation into executive oversight territory.

---

Vendor Defense / Reliance

Cisco has released updates addressing the vulnerabilities. Federal agencies are required to apply patches after evidence preservation steps are complete.

Failure to follow required order — patching before artifact collection — may destroy forensic evidence of compromise.

This directive prioritizes detection before remediation.

---

Forecast — 30 Days

• Increased scanning activity targeting Cisco SD-WAN management interfaces
• Potential public proof-of-concept code circulation
• Secondary exploitation attempts targeting delayed patch adopters
• Heightened federal oversight of SD-WAN segmentation practices
• Expanded hardening guidance from CISA if additional compromise evidence emerges

---

TRJ Verdict

SD-WAN systems are not background infrastructure. They are command infrastructure.

When authentication bypass intersects with root-level privilege escalation inside network orchestration platforms, the threat shifts from vulnerability to strategic risk.

CISA does not issue emergency directives for theoretical weaknesses.

This directive signals confirmed operational exploitation.

Federal networks now face a compressed mitigation window measured in days.

Organizations outside the FCEB structure using Cisco SD-WAN should treat this directive as a public early-warning indicator.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---