1. Home
  2. Vulnerabilities
  3. CVE-2026-20182
Known Exploited Vulnerability
10.0
CRITICAL CVSS 3.1
CVE-2026-20182
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability - [Actively Exploited]
Overview
Description

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.  A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

Details
INFO

Published Date :

May 14, 2026, 5:16 p.m.

Last Modified :

May 15, 2026, 12:45 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.

Required Action :

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Known Ransomware Campaign Use:

Unknown

Notes :

CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW ; https://nvd.nist.gov/vuln/detail/CVE-2026-20182

Impact
Affected Products

The following products are affected by CVE-2026-20182 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Cisco catalyst_sd-wan_manager
2 Cisco sd-wan_vsmart_controller
: Total Affected Vendor : 1 | Products : 2
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL [email protected]
Solution
Update affected systems to patch a vulnerability in peering authentication that allows privilege escalation.
  • Update Cisco Catalyst SD-WAN Controller and Manager software.
  • Implement guidance for Show Control Connections.
  • Monitor system logs for suspicious activity.
  • Apply security patches when available.
Public PoC/Exploit Available at Github

CVE-2026-20182 has a 6 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-20182.

URL Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk Not Applicable
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182 US Government Resource
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-20182 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-20182 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
Nxploited/CVE-2026-20182

Cisco Catalyst SD-WAN Peering Authentication Bypass

Python

Updated: 1 week, 2 days ago
0 stars 0 fork 0 watcher
Born at : May 26, 2026, 6:10 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
HORKimhab/CVE-2026-20182

CVE-2026-20182

Python

Updated: 1 week, 5 days ago
0 stars 0 fork 0 watcher
Born at : May 24, 2026, 5:28 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
portbuster1337/CVE-2026-20182

CVE-2026-20182 PoC - Cisco Catalyst SD-WAN Controller / Manager Authentication Bypass (CVSS 10.0)

authentication-bypass cisco cisco-sd-wan cve exploit penetration-testing poc red-team security vmanage vsmart cve-2026-20182

Python

Updated: 1 week, 6 days ago
0 stars 0 fork 0 watcher
Born at : May 22, 2026, 9:17 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
dfir-g0blin/Detection-Engineering-Portfolio

A sanitized portfolio of high-fidelity detection logic, automated response playbooks, and AI-assisted threat hunting tools.

Python

Updated: 2 weeks, 6 days ago
0 stars 0 fork 0 watcher
Born at : May 15, 2026, 10:12 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
Ali-Jabbar-CS/CyberPulse

None

Python JavaScript HTML TypeScript CSS

Updated: 2 weeks, 6 days ago
0 stars 0 fork 0 watcher
Born at : May 15, 2026, 7:47 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
fangbarristerbar/CVE-2026-20182-POC

CVE-2026-20182 exp - higher success rate + persistence.

Updated: 2 weeks, 6 days ago
0 stars 0 fork 0 watcher
Born at : May 15, 2026, 2:07 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-20182 vulnerability anywhere in the article.

  • security.nl
Cisco waarschuwt voor actief misbruikt beveiligingslek in SD-WAN Manager

Cisco waarschuwt voor een actief misbruikt beveiligingslek in Cisco Catalyst SD-WAN Manager waardoor een aanvaller met toegang tot het systeem willekeurige commando's als root kan uitvoeren. Er zijn u ... Read more

Published Date: Jun 05, 2026 (6 hours, 30 minutes ago)
  • CybersecurityNews
Cisco SD-WAN Vulnerability Exploited in the Wild to Execute Arbitrary Commands as Root User

Cisco has disclosed a high-severity vulnerability in its Catalyst SD-WAN Manager that is actively being exploited in the wild, allowing attackers to execute arbitrary commands with root privileges. Th ... Read more

Published Date: Jun 05, 2026 (7 hours, 30 minutes ago)
  • Proofpoint
More CVEs, Same Playbook: 2026 Vulnerability Exploitation in the Wild

Executive Summary The CVE Landscape Has Changed. The Threat Actors Haven't. Proofpoint's dual telemetry streams — targeted attack visibility covering hundreds of millions of messages daily, and a glob ... Read more

Published Date: May 27, 2026 (1 week, 1 day ago)
  • The Hacker News
Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access

Cisco has rolled out updates for a maximum-severity security flaw impacting Secure Workload that could allow an unauthenticated, remote attacker to access sensitive data. Tracked as CVE-2026-20223 (CV ... Read more

Published Date: May 22, 2026 (2 weeks ago)
  • Daily CyberSecurity
CVSS 10 Alert: Quest KACE SMA Auth Bypass Exploited to Hijack Managed Endpoints

Detailed listing of tools and scripts within the exposed C2 directory | Image: Hunt Cybersecurity researchers have just dropped a report on a critical “management plane” threat that has spent the last ... Read more

Published Date: May 16, 2026 (2 weeks, 6 days ago)
  • TheCyberThrone
CVE-2026-42897 — Microsoft Exchange Server OWA XSS Vulnerability

OverviewMicrosoft has confirmed active exploitation of CVE-2026-42897, a Cross-Site Scripting vulnerability in Microsoft Exchange Server carrying a CVSS score of 8.1.The flaw stems from improper neutr ... Read more

Published Date: May 15, 2026 (2 weeks, 6 days ago)
  • TheCyberThrone
CVE-2026-20182 – Cisco Catalyst SD-WAN Auth Bypass to KEV

OverviewCVE-2026-20182 carries a CVSSv3.1 score of 10.0 (Critical) and is classified under CWE-287: Improper Authentication. The flaw affects the Cisco Catalyst SD-WAN Controller (formerly vSmart), wh ... Read more

Published Date: May 15, 2026 (2 weeks, 6 days ago)
  • security.nl
Cisco waarschuwt voor actief misbruikt lek in Catalyst SD-WAN Controller

Cisco waarschuwt voor een actief misbruikte kwetsbaarheid in de Catalyst SD-WAN Controller waardoor een ongeauthenticeerde aanvaller admin-toegang tot het systeem kan krijgen. Er zijn beveiligingsupda ... Read more

Published Date: May 15, 2026 (3 weeks ago)
  • The Hacker News
CISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access Exploits

The U.S.Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a newly disclosed vulnerability impacting Cisco Catalyst SD-WAN Controller to its Known Exploited Vulnerabilities (KEV ... Read more

Published Date: May 15, 2026 (3 weeks ago)
  • CybersecurityNews
Cisco Catalyst SD-WAN Controller 0-Day Actively Exploited to Gain Admin Access

A maximum-severity zero-day vulnerability in Cisco Catalyst SD-WAN Controller is being actively exploited in the wild, allowing unauthenticated remote attackers to fully bypass authentication and seiz ... Read more

Published Date: May 15, 2026 (3 weeks ago)
  • The Hacker News
Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access

Cisco has released updates to address a maximum-severity authentication bypass flaw in Catalyst SD-WAN Controller that it said has been exploited in limited attacks. The vulnerability, tracked as CVE- ... Read more

Published Date: May 14, 2026 (3 weeks ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-20182 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    May. 15, 2026

    Action Type Old Value New Value
    Added CPE Configuration OR *cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* versions up to (excluding) 20.9.9.1 *cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* versions from (including) 20.12.6 up to (excluding) 20.12.6.2 *cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* versions from (including) 20.13 up to (excluding) 20.15.4.4 *cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* versions from (including) 20.15.5 up to (excluding) 20.15.5.2 *cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* versions from (including) 20.16 up to (excluding) 20.18.2.2 *cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* versions from (including) 26.1 up to (excluding) 26.1.1.1 *cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.7:*:*:*:*:*:*:* *cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* versions from (including) 20.10 up to (excluding) 20.12.5.4 *cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* versions up to (excluding) 20.9.9.1 *cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* versions from (including) 20.10 up to (excluding) 20.12.5.4 *cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* versions from (including) 20.12.6 up to (excluding) 20.12.6.2 *cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* versions from (including) 20.13 up to (excluding) 20.15.4.4 *cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* versions from (including) 20.15.5 up to (excluding) 20.15.5.2 *cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* versions from (including) 20.16 up to (excluding) 20.18.2.2 *cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* versions from (including) 26.1 up to (excluding) 26.1.1.1 *cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.12.7:*:*:*:*:*:*:*
    Added Reference Type Cisco Systems, Inc.: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW Types: Vendor Advisory
    Added Reference Type Cisco Systems, Inc.: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk Types: Not Applicable
    Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182 Types: US Government Resource
  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    May. 14, 2026

    Action Type Old Value New Value
    Added Date Added 2026-05-14
    Added Due Date 2026-05-14
    Added Required Action 2026-05-14
    Added Vulnerability Name 2026-05-14
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    May. 14, 2026

    Action Type Old Value New Value
    Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182
  • New CVE Received by [email protected]

    May. 14, 2026

    Action Type Old Value New Value
    Added Description May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.  A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    Added CWE CWE-287
    Added Reference https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
    Added Reference https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 10.0
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact