NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Cisco Catalyst SD-WAN authentication bypass CVE-2026-20182 exploited; fixes released

Attackers used CVE-2026-20182 to gain privileged access to Cisco Catalyst SD-WAN business networks without credentials. Fixes cover Controller, Manager and Validator. Ask IT to preserve logs, update every control component and check for compromise.

What to do

Nothing to install on a family phone or computer: this affects business network infrastructure. If your business or family office uses Cisco Catalyst SD-WAN, ask its IT provider to preserve diagnostic logs, upgrade every control component to the appropriate fixed release below, and arrange a compromise check with Cisco support.

What’s happening

CVE-2026-20182 lets a remote attacker bypass the checks that authenticate connections between Cisco Catalyst SD-WAN components and gain privileged access without credentials. It affects Controller, Manager and Validator, formerly vSmart, vManage and vBond, across on-premises and cloud deployments. Rapid7 reported the flaw privately in March; Cisco disclosed it with fixes on 14 May. Cisco Talos reported limited attacks attributed to UAT-8616, including attempts to establish lasting access and gain root privileges. CISA listed it as exploited that day. Cisco expanded the affected-product list to include Validator on 16 June. Released fixes cover the supported affected branches, and Cisco’s managed cloud service was updated to 20.15.506. Older releases require migration. Administrators must also check for compromise: patching alone does not remove an existing intrusion. The reviewed sources do not establish that attacks have ended.

What
Flaw
Affects
Cisco Catalyst SD-WAN Controller, Manager and Validator
Affected
Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage) and Validator (formerly vBond), regardless of configuration, on vulnerable releases in the branches below.
Earlier than 20.9; 20.10; 20.11; 20.13; 20.14; 20.16: migrate to a fixed release.
20.9 before 20.9.9.1.
20.12 releases before the applicable fixes 20.12.5.4, 20.12.6.2 or 20.12.7.1.
20.15 releases before the applicable fixes 20.15.4.4 or 20.15.5.2.
20.18 before 20.18.2.2; 26.1 before 26.1.1.1.
Deployment types include on-premises, Cisco SD-WAN Cloud-Pro, Cisco SD-WAN Cloud (Cisco Managed) and Cisco SD-WAN for Government (FedRAMP).
Fixed in
20.9.9.1
20.12.5.4
20.12.6.2
20.12.7.1
20.15.4.4
20.15.5.2
20.18.2.2
26.1.1.1
Cisco SD-WAN Cloud (Cisco Managed) 20.15.506
CVE
CVE-2026-20182
Since
14 May 2026
Closed
16 June 2026

Timeline

  1. Vendor revised

    Cisco added Catalyst SD-WAN Validator, formerly vBond, to the affected products. This remains the advisory’s latest revision as at 3 November.

  2. Vendor revised

    Cisco strengthened the advisory’s instructions for retaining logs, checking for compromise and contacting support. An already compromised system needs additional remediation beyond installing the update.

  3. Vendor revised

    Cisco updated its remediation guide, including upgrade guidance for customers moving from 20.9 to 20.12. It instructed administrators to collect diagnostic logs before upgrading and have Cisco support check them for compromise.

  4. CISA added

    CISA added CVE-2026-20182 to its Known Exploited Vulnerabilities catalogue, with a remediation deadline of 17 May for affected federal agencies.

  5. Update

    Cisco Talos reported limited exploitation attributed to UAT-8616. The attackers attempted to add access keys, change network configuration and gain root privileges.

  6. Made publicFixed

    Cisco publicly disclosed CVE-2026-20182 and released fixes for Catalyst SD-WAN. It rated the flaw critical, with a CVSS score of 10.0.

  7. Update

    Rapid7 privately reported the newly discovered authentication bypass to Cisco. Cisco confirmed the findings on 20 March.

Sources

  1. Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCisco · 16 June 2026
  2. CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller (FIXED)Rapid7 · 14 May 2026
  3. Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilitiesCisco Talos · 14 May 2026
  4. AL26-012 — Critical vulnerability affecting Cisco Catalyst SD-WAN — CVE-2026-20182Canadian Centre for Cyber Security · 15 May 2026
  5. Remediate Catalyst SD-WAN Security Advisory — May 2026Cisco · 18 May 2026
  6. Known Exploited Vulnerabilities catalogue — 3 November 2026 editionCISA · 3 Nov 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from May 2026 · JSON · RSS