{"id":"cisco-sdwan-authentication-bypass-may-2026","category":"patch","status":"closed","title":"Cisco Catalyst SD-WAN authentication bypass CVE-2026-20182 exploited; fixes released","tldr":"Attackers used CVE-2026-20182 to gain privileged access to Cisco Catalyst SD-WAN business networks without credentials. Fixes cover Controller, Manager and Validator. Ask IT to preserve logs, update every control component and check for compromise.","summary":"CVE-2026-20182 lets a remote attacker bypass the checks that authenticate connections between Cisco Catalyst SD-WAN components and gain privileged access without credentials. It affects Controller, Manager and Validator, formerly vSmart, vManage and vBond, across on-premises and cloud deployments. Rapid7 reported the flaw privately in March; Cisco disclosed it with fixes on 14 May. Cisco Talos reported limited attacks attributed to UAT-8616, including attempts to establish lasting access and gain root privileges. CISA listed it as exploited that day. Cisco expanded the affected-product list to include Validator on 16 June. Released fixes cover the supported affected branches, and Cisco’s managed cloud service was updated to 20.15.506. Older releases require migration. Administrators must also check for compromise: patching alone does not remove an existing intrusion. The reviewed sources do not establish that attacks have ended.","action":"Nothing to install on a family phone or computer: this affects business network infrastructure. If your business or family office uses Cisco Catalyst SD-WAN, ask its IT provider to preserve diagnostic logs, upgrade every control component to the appropriate fixed release below, and arrange a compromise check with Cisco support.","product":"Cisco Catalyst SD-WAN Controller, Manager and Validator","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-20182"],"tags":["cisco","sd-wan","authentication-bypass","actively-exploited","network"],"affected":["Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage) and Validator (formerly vBond), regardless of configuration, on vulnerable releases in the branches below.","Earlier than 20.9; 20.10; 20.11; 20.13; 20.14; 20.16: migrate to a fixed release.","20.9 before 20.9.9.1.","20.12 releases before the applicable fixes 20.12.5.4, 20.12.6.2 or 20.12.7.1.","20.15 releases before the applicable fixes 20.15.4.4 or 20.15.5.2.","20.18 before 20.18.2.2; 26.1 before 26.1.1.1.","Deployment types include on-premises, Cisco SD-WAN Cloud-Pro, Cisco SD-WAN Cloud (Cisco Managed) and Cisco SD-WAN for Government (FedRAMP)."],"fixed":["20.9.9.1","20.12.5.4","20.12.6.2","20.12.7.1","20.15.4.4","20.15.5.2","20.18.2.2","26.1.1.1","Cisco SD-WAN Cloud (Cisco Managed) 20.15.506"],"matches":[],"sources":[{"kind":"advisory","title":"Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW","by":"Cisco","date":"2026-06-16"},{"kind":"research","title":"CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller (FIXED)","url":"https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/","by":"Rapid7","date":"2026-05-14"},{"kind":"research","title":"Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities","url":"https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/","by":"Cisco Talos","date":"2026-05-14"},{"kind":"advisory","title":"AL26-012 — Critical vulnerability affecting Cisco Catalyst SD-WAN — CVE-2026-20182","url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-012-critical-vulnerability-affecting-cisco-catalyst-sd-wan-cve-2026-20182","by":"Canadian Centre for Cyber Security","date":"2026-05-15"},{"kind":"advisory","title":"Remediate Catalyst SD-WAN Security Advisory — May 2026","url":"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/225842-remediate-catalyst-sd-wan-security.html","by":"Cisco","date":"2026-05-18"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue — 3 November 2026 edition","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"}],"started":"2026-05-14","closed":"2026-06-16","created":"2026-11-03T22:23:29.879Z","updated":"2026-11-03T22:23:29.879Z","cve_notes":[{"cve":"CVE-2026-20182","name":"Authentication bypass in Cisco Catalyst SD-WAN","what":"Faulty connection authentication in Cisco Catalyst SD-WAN Controller, Manager and Validator lets a remote attacker gain privileged access without credentials and change network configuration.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-06-16","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Cisco added Catalyst SD-WAN Validator, formerly vBond, to the affected products. This remains the advisory’s latest revision as at 3 November.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW","by":"Cisco","patch":null},{"at":"2026-05-27","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Cisco strengthened the advisory’s instructions for retaining logs, checking for compromise and contacting support. An already compromised system needs additional remediation beyond installing the update.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW","by":"Cisco","patch":null},{"at":"2026-05-18","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Cisco updated its remediation guide, including upgrade guidance for customers moving from 20.9 to 20.12. It instructed administrators to collect diagnostic logs before upgrading and have Cisco support check them for compromise.","url":"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/225842-remediate-catalyst-sd-wan-security.html","by":"Cisco","patch":null},{"at":"2026-05-14","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-20182 to its Known Exploited Vulnerabilities catalogue, with a remediation deadline of 17 May for affected federal agencies.","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-05-14","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Cisco Talos reported limited exploitation attributed to UAT-8616. The attackers attempted to add access keys, change network configuration and gain root privileges.","url":"https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/","by":"Cisco Talos","patch":null},{"at":"2026-05-14","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Cisco publicly disclosed CVE-2026-20182 and released fixes for Catalyst SD-WAN. It rated the flaw critical, with a CVSS score of 10.0.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW","by":"Cisco","patch":"patched"},{"at":"2026-03-09","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Rapid7 privately reported the newly discovered authentication bypass to Cisco. Cisco confirmed the findings on 20 March.","url":"https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/","by":"Rapid7","patch":null}],"url":"https://hard.fyi/live/cisco-sdwan-authentication-bypass-may-2026/","json":"https://hard.fyi/api/live?id=cisco-sdwan-authentication-bypass-may-2026"}