CVE-2026-20182

10.0

CRITICAL CVSS 3.1

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability - [Actively Exploited]

Overview

Description

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.  A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

Details

INFO

Published Date :

May 14, 2026, 5:16 p.m.

Last Modified :

June 16, 2026, 7:16 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: May 17, 2026

Alert Date: May 14, 2026 | 42 days ago

Description :

Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.

Required Action :

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Known Ransomware Campaign Use:

Unknown

Notes :

CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW ; https://nvd.nist.gov/vuln/detail/CVE-2026-20182

Impact

Affected Products

The following products are affected by CVE-2026-20182 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Cisco	catalyst_sd-wan_manager
2	Cisco	sd-wan_vsmart_controller

: Total Affected Vendor : 1 | Products : 2

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]

Solution

Update affected systems to patch a vulnerability in peering authentication that allows privilege escalation.

Update Cisco Catalyst SD-WAN Controller and Manager software.
Implement guidance for Show Control Connections.
Monitor system logs for suspicious activity.
Apply security patches when available.

Public PoC/Exploit Available at Github

CVE-2026-20182 has a 11 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-20182.

URL	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk	Not Applicable
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-20182 is associated with the following CWEs:

CWE-287: Improper Authentication

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-20182 weaknesses.

CAPEC-22: Exploiting Trust in Client Exploiting Trust in Client CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data Utilizing REST's Trust in the System Resource to Obtain Sensitive Data CAPEC-94: Adversary in the Middle (AiTM) Adversary in the Middle (AiTM) CAPEC-114: Authentication Abuse Authentication Abuse CAPEC-115: Authentication Bypass Authentication Bypass CAPEC-151: Identity Spoofing Identity Spoofing CAPEC-194: Fake the Source of Data Fake the Source of Data CAPEC-593: Session Hijacking Session Hijacking CAPEC-633: Token Impersonation Token Impersonation CAPEC-650: Upload a Web Shell to a Web Server Upload a Web Shell to a Web Server

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

theonedre/vector-five9-platform

Serverless vulnerability management platform built on AWS. Monitors NIST NVD for CVEs matching network device inventory, scores by CVSS, correlates to MITRE ATT&CK techniques, and auto-creates prioritized ServiceNow incidents.

Updated: 2 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : June 10, 2026, 1:32 a.m. This repo has been linked 1 different CVEs too.

Beth-Watt/Real-Security-Analysis

Real-world security incident analysis through a risk and compliance lens

Updated: 1 week, 4 days ago

0 stars 0 fork 0 watcher

Born at : June 3, 2026, 12:54 p.m. This repo has been linked 2 different CVEs too.

Nxploited/CVE-2026-20182

Cisco Catalyst SD-WAN Peering Authentication Bypass

Python

Updated: 4 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : May 26, 2026, 6:10 p.m. This repo has been linked 1 different CVEs too.

HORKimhab/CVE-2026-20182

CVE-2026-20182

Python

Updated: 1 month ago

0 stars 0 fork 0 watcher

Born at : May 24, 2026, 5:28 a.m. This repo has been linked 1 different CVEs too.

portbuster1337/CVE-2026-20182

CVE-2026-20182 PoC - Cisco Catalyst SD-WAN Controller / Manager Authentication Bypass (CVSS 10.0)

authentication-bypass cisco cisco-sd-wan cve exploit penetration-testing poc red-team security vmanage vsmart cve-2026-20182

Python

Updated: 1 month ago

0 stars 0 fork 0 watcher

Born at : May 22, 2026, 9:17 p.m. This repo has been linked 1 different CVEs too.

barmi/cve-patch-auditor

Audit CVE impact, patch status, remediation progress, and verification results across systems.

Makefile Go

Updated: 2 weeks, 5 days ago

3 stars 2 fork 2 watcher

Born at : May 16, 2026, 2:19 a.m. This repo has been linked 25 different CVEs too.

dfir-g0blin/Detection-Engineering-Portfolio

A sanitized portfolio of high-fidelity detection logic, automated response playbooks, and AI-assisted threat hunting tools.

Python

Updated: 1 month, 1 week ago

0 stars 0 fork 0 watcher

Born at : May 15, 2026, 10:12 p.m. This repo has been linked 1 different CVEs too.

Ali-Jabbar-CS/CyberPulse

None

Python JavaScript HTML TypeScript CSS

Updated: 1 month, 1 week ago

0 stars 0 fork 0 watcher

Born at : May 15, 2026, 7:47 p.m. This repo has been linked 1 different CVEs too.

fangbarristerbar/CVE-2026-20182-POC

CVE-2026-20182 exp - higher success rate + persistence.

Updated: 1 month, 1 week ago

0 stars 0 fork 0 watcher

Born at : May 15, 2026, 2:07 p.m. This repo has been linked 1 different CVEs too.

zulloper/cve-poc

CVE POC repo 자동 수집기

Python

Updated: 2 weeks, 4 days ago

13 stars 5 fork 5 watcher

Born at : June 8, 2025, 3:07 p.m. This repo has been linked 338 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 2 weeks, 4 days ago

7810 stars 1261 fork 1261 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 718 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-20182 vulnerability anywhere in the article.

The Hacker News

Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access

An unknown threat actor exploited a recently disclosed high-severity security flaw impacting Cisco Catalyst SD-WAN as a zero-day at least two months before it was publicly disclosed, according to new ...

Published Date: Jun 25, 2026 (13 hours, 10 minutes ago)

The Hacker News

Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw

Cisco has released security updates for a medium-severity security flaw in Catalyst SD-WAN Manager that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-20262, ca ...

Published Date: Jun 16, 2026 (1 week, 2 days ago)

TheCyberThrone

CISA adds Cisco SD-WAN and LiteSpeed cPanel to KEV

June 16, 2026CVE-2026-20262 | Cisco Catalyst SD-WAN Manager — Path TraversalCVE-2026-20262 is a directory or path traversal vulnerability in Cisco Catalyst SD-WAN Manager. This class of flaw allows at ...

Published Date: Jun 16, 2026 (1 week, 2 days ago)

TheCyberThrone

CISA KEV Update — Cisco Catalyst SD-WAN, Google Chrome V8 & Arista EOS

CISA added three new vulnerabilities to its Known Exploited Vulnerabilities catalog on June 9, 2026: CVE-2026-20245 (Cisco Catalyst SD-WAN Manager), CVE-2026-11645 (Google Chromium V8), and CVE-2026-7 ...

Published Date: Jun 10, 2026 (2 weeks, 1 day ago)

The Cyber Express

Cisco Warns of Active Exploitation of Catalyst SD-WAN Flaw With No Patch Available

Cisco has issued an urgent warning that a high-severity vulnerability in its Catalyst SD-WAN Manager platform is being actively exploited in the wild—and no patch exists yet. CVE-2026-20245 allows aut ...

Published Date: Jun 08, 2026 (2 weeks, 3 days ago)

TheCyberThrone

CVE-2026-20245 — Cisco Catalyst SD-WAN Manager Privilege Escalation

June 6, 2026The Core FlawCVE-2026-20245 affects the command-line interface of Cisco Catalyst SD-WAN Manager and stems from insufficient validation of user-supplied input. An authenticated local attack ...

Published Date: Jun 06, 2026 (2 weeks, 5 days ago)

The Hacker News

Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available

Cisco has warned that a high-severity security flaw impacting Catalyst SD-WAN Manager has come under active exploitation. The vulnerability, tracked as CVE-2026-20245, carries a CVSS score of 7.8 out ...

Published Date: Jun 06, 2026 (2 weeks, 5 days ago)

security.nl

Cisco waarschuwt voor actief misbruikt beveiligingslek in SD-WAN Manager

Cisco waarschuwt voor een actief misbruikt beveiligingslek in Cisco Catalyst SD-WAN Manager waardoor een aanvaller met toegang tot het systeem willekeurige commando's als root kan uitvoeren. Er zijn u ...

Published Date: Jun 05, 2026 (2 weeks, 6 days ago)

CybersecurityNews

Cisco SD-WAN Vulnerability Exploited in the Wild to Execute Arbitrary Commands as Root User

Cisco has disclosed a high-severity vulnerability in its Catalyst SD-WAN Manager that is actively being exploited in the wild, allowing attackers to execute arbitrary commands with root privileges. Th ...

Published Date: Jun 05, 2026 (2 weeks, 6 days ago)

Proofpoint

More CVEs, Same Playbook: 2026 Vulnerability Exploitation in the Wild

Executive Summary The CVE Landscape Has Changed. The Threat Actors Haven't. Proofpoint's dual telemetry streams — targeted attack visibility covering hundreds of millions of messages daily, and a glob ...

Published Date: May 27, 2026 (4 weeks, 1 day ago)

The Hacker News

Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access

Cisco has rolled out updates for a maximum-severity security flaw impacting Secure Workload that could allow an unauthenticated, remote attacker to access sensitive data. Tracked as CVE-2026-20223 (CV ...

Published Date: May 22, 2026 (1 month ago)

Daily CyberSecurity

CVSS 10 Alert: Quest KACE SMA Auth Bypass Exploited to Hijack Managed Endpoints

Detailed listing of tools and scripts within the exposed C2 directory | Image: Hunt Cybersecurity researchers have just dropped a report on a critical “management plane” threat that has spent the last ...

Published Date: May 16, 2026 (1 month, 1 week ago)

TheCyberThrone

CVE-2026-42897 — Microsoft Exchange Server OWA XSS Vulnerability

OverviewMicrosoft has confirmed active exploitation of CVE-2026-42897, a Cross-Site Scripting vulnerability in Microsoft Exchange Server carrying a CVSS score of 8.1.The flaw stems from improper neutr ...