The vulnerability resides in the peering authentication mechanism of the Cisco Catalyst SD‑WAN Controller (formerly SD‑WAN vSmart) and Manager (formerly SD‑WAN vManage). An attacker who can send crafted requests to the control connection handshake can bypass authentication and obtain a high‑privileged, non‑root administrative account. This enables the attacker to access NETCONF and modify network configuration across the SD‑WAN fabric, potentially disrupting connectivity or implementing malicious routes.

Affected are Cisco Catalyst SD‑WAN Controller and Cisco Catalyst SD‑WAN Manager. No specific version range is disclosed, so all currently deployed instances remain vulnerable until the vendor issues the remedial software.

With a CVSS score of 10, this flaw is considered critical. The vulnerability is listed in the CISA KEV catalog, underscoring its exploitation relevance. The advisory notes that an unauthenticated, remote attacker can exploit the flaw simply by sending crafted requests; no additional authentication or privileged network location is required, indicating a high likelihood of exploitation in targeted environments. EPSS score of 2%, reflecting a modest exploitation probability, while the KEV listing underscores active exploitation activity.