{"id":"CVE-2026-20182","published":"2026-05-14T17:16:19Z","modified":"2026-10-26T14:10:00Z","title":"Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability","vendor":"Cisco","product":"Catalyst SD-WAN","tier":"core","eol":null,"description":{"text":"May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the  was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The  section of this advisory includes Show Control Connections guidance to help with system checks. \r\n\r\nA vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.\r\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller (formerly vSmart), Cisco Catalyst SD-WAN Manager (formerly vManage), and Cisco Catalyst SD-WAN Validator (formerly vBond) causes improper authentication during control connection handshaking. An unauthenticated remote attacker who sends crafted requests to an affected system can bypass authentication and log in as an internal, high-privileged, non-root account, then use NETCONF to manipulate the SD-WAN fabric's network configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:02:47Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.91817,"percentile":0.99816,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-05-14","dueDate":"2026-05-17","ransomware":false,"requiredAction":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","notes":"CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW ; https://nvd.nist.gov/vuln/detail/CVE-2026-20182","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-05-14","exploitedFirstSeen":"2026-05-14","ransomware":false,"evidence":[{"url":"https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/","date":"2026-05-14"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW","date":"2026-05-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-05-14"},{"url":"https://x.com/stephenfewer/status/2054959580333965761?s=20","date":"2026-05-14"},{"url":"https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild","date":"2026-05-27"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk","tags":["Not Applicable"]},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote exploit of public-facing service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"could allow an unauthenticated, remote attacker to bypass authentication","start":584,"end":656}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-78e2285773915bb291c1","title":"ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/","date":"2024-04-24","mentions":[{"quote":"Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage.","start":22742,"end":22968}]},{"id":"SRC-29d0b86e8592bf01f10c","title":"Breaking the silence","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/","date":"2022-12-08","mentions":[{"quote":"Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage.","start":23887,"end":24113}]},{"id":"SRC-85c03a59069479556202","title":"TeamTNT Targeting AWS, Alibaba","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/","date":"2022-04-21","mentions":[{"quote":"Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage.","start":30605,"end":30831}]},{"id":"SRC-65ab06ae92274f14e50e","title":"DNS Hijacking Abuses Trust In Core Internet Service","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/seaturtle/","date":"2019-04-17","mentions":[{"quote":"Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage.","start":21589,"end":21815}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-30324","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30324","exploited":true,"exploitedSince":"2026-05-14","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2026-05-22","earliestUrl":"https://github.com/portbuster1337/CVE-2026-20182","repos":[{"name":"portbuster1337/CVE-2026-20182","url":"https://github.com/portbuster1337/CVE-2026-20182","stars":3,"created":"2026-05-22"},{"name":"Nxploited/CVE-2026-20182","url":"https://github.com/Nxploited/CVE-2026-20182","stars":1,"created":"2026-05-26"},{"name":"HORKimhab/CVE-2026-20182","url":"https://github.com/HORKimhab/CVE-2026-20182","stars":0,"created":"2026-05-24"}]},"metasploit":[{"name":"Cisco Catalyst SD-WAN Controller vHub Authentication Bypass","module":"auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass","type":"auxiliary","disclosureDate":"2026-05-07","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb"}],"first":{"date":"2026-05-07","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"}],"timeline":[{"date":"2019-04-17","kind":"report","label":"Named in blog.talosintelligence.com: DNS Hijacking Abuses Trust In Core Internet Service","url":"https://blog.talosintelligence.com/seaturtle/","provenance":"machine"},{"date":"2022-04-21","kind":"report","label":"Named in blog.talosintelligence.com: TeamTNT Targeting AWS, Alibaba","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/","provenance":"machine"},{"date":"2022-12-08","kind":"report","label":"Named in blog.talosintelligence.com: Breaking the silence","url":"https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/","provenance":"machine"},{"date":"2024-04-24","kind":"report","label":"Named in blog.talosintelligence.com: ArcaneDoor - New espionage-focused campaign found targeting perimeter network devi…","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/","provenance":"machine"},{"date":"2026-05-07","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2026-05-22","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb","provenance":"source"},{"date":"2026-05-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20182","provenance":"source"},{"date":"2026-05-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/","provenance":"source"},{"date":"2026-05-14","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-05-14","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30324","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":0},"priority":{"score":83.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 170 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9982"},{"name":"Named in threat reports","points":8.98,"detail":"4 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}