VulnSocial
← Back to blog

CVE-2026-20182 – Critical Authentication Bypass in Cisco Catalyst SD‑WAN Controller

Key takeaways

  • Critical authentication bypass (CVSS 10.0) in Cisco Catalyst SD‑WAN Controller.
  • Unauthenticated remote attacker can obtain admin‑level access and execute NETCONF commands.
  • Actively exploited in the wild; added to CISA KEV on 2026‑05‑14.
  • Affected versions include 20.12.7 and earlier.
  • Immediate patch to the latest release; verify version and monitor for suspicious NETCONF activity.

Overview

CVE-2026-20182 is a Critical authentication bypass vulnerability discovered in early May 2026 in the Cisco Catalyst SD‑WAN Controller (formerly vSmart and vManage). The flaw allows an unauthenticated remote attacker to bypass the peering authentication mechanism, log in as a high‑privileged non‑root user, and gain unrestricted NETCONF access to the SD‑WAN fabric. Cisco confirmed that the vulnerability is being exploited as a zero‑day and added it to the CISA KEV catalog on 2026‑05‑14.

Technical Details

The vulnerability resides in the control‑connection handshaking process used for peering authentication between SD‑WAN components. The authentication check can be bypassed by sending crafted HTTP/HTTPS requests that omit or manipulate the expected authentication token. Successful exploitation grants the attacker a privileged account that can:

  • Access NETCONF over the management interface.
  • Read, modify, or delete SD‑WAN configuration objects.
  • Propagate malicious changes across the entire SD‑WAN fabric.

The issue is classified as Improper Authentication (CWE‑287). The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, resulting in a base score of 10.0.

Severity & Impact

CVECVSSSeverityVector
CVE-2026-2018210.0CriticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

A remote unauthenticated attacker can obtain admin‑level rights, enabling full control of the SD‑WAN environment. Potential consequences include network traffic interception, data exfiltration, service disruption, and lateral movement within the enterprise.

Affected Products

The flaw affects the following Cisco SD‑WAN components:

  • Cisco Catalyst SD‑WAN Manager (vManage)
  • Cisco Catalyst SD‑WAN vSmart Controller

All releases up to and including 20.12.7 are vulnerable. For a complete list of affected versions and CPE identifiers, see the CVE page.

Actionable Insights

  • Verify your deployment – Run show version on each SD‑WAN controller to confirm the software version. 
    show version
  • Apply the Cisco patch – Upgrade to the fixed release (≥ 20.12.7) as described in Cisco Security Advisory 1 and 2.
  • Validate the patch – After upgrade, confirm the patch level with show patch or show version. 
    show patch
  • Monitor NETCONF activity – Enable logging for NETCONF sessions and alert on any unauthorized access attempts.
  • Restrict management access – Use ACLs or firewall rules to limit inbound management traffic to trusted IP ranges.
  • Follow CISA KEV guidance – Review the emergency directive and hardening recommendations for Cisco SD‑WAN devices.
  • Leverage threat intel – Track real‑time indicators of compromise (IOCs) on the VulnSocial CVE page to detect active exploitation attempts.

Remediation & Mitigation

  1. Patch immediately – Download and install the Cisco security advisory releases: 
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
  2. Verify the fix – Confirm the installed version is ≥ 20.12.7 and that the patch identifier appears in the system output.
  3. If patching is delayed, isolate the controller from untrusted networks, enforce strong authentication (e.g., multi‑factor), and disable unused peering interfaces.
  4. Audit NETCONF credentials – Rotate any NETCONF keys or passwords that may have been exposed.
  5. Implement CISA recommendations – Apply the emergency directive and hardening guidance linked in the CISA KEV entry: 
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182

For continuous visibility into exploitation trends, consult the live threat timeline on the VulnSocial CVE page.

Bottom line

CVE-2026-20182 is a Critical authentication bypass in Cisco Catalyst SD‑WAN Controller that is actively exploited. Deploy the Cisco patch immediately, verify your software version, and monitor for unauthorized NETCONF activity. Federal agencies must comply with the CISA KEV directive.

References

  • Cisco Security Advisory – Initial Release 
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
  • Cisco Security Advisory – Updated Patch Information 
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
  • CISA Known Exploited Vulnerabilities Catalog (KEV) entry for CVE-2026-20182 
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182
  • VulnSocial CVE details (real‑time intel) 
    https://vulnsocial.com/cve/CVE-2026-20182
  • VulnSocial home page (threat monitoring) 
    https://vulnsocial.com

#CVE #CVE202620182 #Critical #Cisco #SDWAN #CISAKEV #AuthenticationBypass