Back Csa.Sg

Active Exploitation of Critical Vulnerability in Cisco Catalyst SD

Csa.Sg • May 15, 2026

Cisco has released security updates to address a critical vulnerability in Cisco Catalyst SD-WAN Controller. Users and administrators of affected products are advised to update to the latest versions immediately.

Cisco has released security updates to address a critical authentication bypass vulnerability (CVE-2026-20182) affecting Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager. This vulnerability has a Common Vulnerability Scoring System (CVSS v3.1) score of 10.0 out of 10.

Due to the peering authentication mechanism in the control connection handshake not functioning properly, an unauthenticated remote attacker could send crafted requests to bypass authentication and gain administrative privileges on the affected system, enabling the attacker to access NETCONF and manipulate network configuration for the entire SD-WAN fabric.

This vulnerability is being actively exploited in the wild.

This vulnerability affects Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager, regardless of device configuration.

This vulnerability affects all deployment types, including:

Cisco SD-WAN Cloud-Pro

Cisco SD-WAN Cloud (Cisco Managed)

Cisco SD-WAN for Government (FedRAMP)

This vulnerability affects the following Cisco Catalyst SD-WAN versions:

All releases earlier than 20.9

Users and administrators of affected products are advised to update to the latest versions immediately.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Zero-Day Vulnerability CVE-2026-20182 Exploited in Cisco SD-WAN Systems Cisco has disclosed a critical authentication bypass vulnerability, CVE-2026-20182, affecting its Catalyst SD-WAN Controller and Manager. This flaw allows unauthenticated remote attackers to bypass authentication and gain administrative privileges, enabling manipulation of network configurations. The vulnerability has a CVSS score of 10.0 and is actively exploited in the wild by a threat actor known as UAT-8616, who previously exploited a similar vulnerability, CVE-2026-20127. Cisco became aware of the exploitation in May 2026 and has released patches to address the issue. Organizations are urged to apply these updates immediately, as there are no effective workarounds. The vulnerability impacts all deployment types of the Cisco Catalyst SD-WAN, including cloud and on-premises solutions. Security advisories have been issued to monitor for unauthorized access attempts. 131 sources 87

Extracted Entities

Active Exploitation of Critical Vulnerability in Cisco Catalyst SD

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (3)