CVE-2026-20182

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Exploited in the wild. In CISA KEV since 2026‑05‑14. A vendor fix is available.

CVSS 3.110.0Critical EPSS percentile99th92% chance in 30 days CISA KEVListedsince 2026-05-14, due 2026-05-17
Public exploit: 0 sources FixVendor fixNo build named by the sources

Published 2026-05-14Updated 2026-06-17Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run any of these products: catalyst sd-wan manager, cisco catalyst sd-wan controller, sd-wan vbond orchestrator, sd-wan vsmart controller.
In each system, verify your installed version and whether it is earlier than 20.9.9.1.
Upgrade the affected component(s) to the fixed version 20.9.9.1 (catalyst sd-wan manager, sd-wan vbond orchestrator, and sd-wan vsmart controller).
If you cannot patch immediately, restrict network access to the SD-WAN control interfaces (allow only trusted sources) until you can upgrade.
Review logs and alerting for unusual authentication/peering activity around the control-plane interaction after any changes, and confirm services remain stable after upgrading.

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.  A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

In plain language

Written by AI from the record

A remote attacker may bypass login on Cisco Catalyst SD-WAN Controller products and take over administrative access, so typical small businesses using these systems should treat it as an urgent fix.

CVE-2026-20182 is an authentication bypass in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller (and related SD-WAN Controller/Manager/VBond components), allowing unauthenticated remote crafted requests to bypass authentication and obtain administrative privileges.

If you're affected

Full SD-WAN configuration takeover
Network disruption or outage
Unauthorized traffic redirection
Administrative control loss

What is it

Think of the SD-WAN controller as the “traffic dispatcher” that decides how your sites connect. This bug can let an attacker skip the normal login checks, then gain admin-level control. Once they have that control, they could change your SD-WAN settings in ways that redirect traffic or disrupt connectivity.

Who is affected

This matters if your business uses Cisco Catalyst SD-WAN Controller products such as catalyst sd-wan manager, cisco catalyst sd-wan controller, sd-wan vbond orchestrator, or sd-wan vsmart controller.

Because the vulnerability is remote and does not require authentication or user interaction, you should assume it’s a serious risk if the affected control-plane endpoint is reachable from the network where attackers could reach it. The findings don’t confirm whether it’s reachable in default configurations, so exposure depends on your network reachability and configuration.

How urgent is it

This is RED because it’s in CISA’s Known Exploited Vulnerabilities catalog and has a CISA remediation deadline of 2026-05-17. Attackers can bypass authentication remotely and reach administrative control, which means there’s a realistic path to full SD-WAN configuration manipulation.

What to do — in detail

Confirm whether you’re exposed

Identify every SD-WAN system you operate that falls under these products: catalyst sd-wan manager, cisco catalyst sd-wan controller, sd-wan vbond orchestrator, sd-wan vsmart controller.
For each system, record the exact software version.
Determine whether your version is earlier than the fixed version 20.9.9.1. (This CVE’s listed fixed version is 20.9.9.1 for the Catalyst SD-WAN Manager, SD-WAN VBond Orchestrator, and SD-WAN vSmart Controller.)

Patch plan (target version)

Upgrade affected components to 20.9.9.1:
- catalyst sd-wan manager → upgrade to 20.9.9.1
- sd-wan vbond orchestrator → upgrade to 20.9.9.1
- sd-wan vsmart controller → upgrade to 20.9.9.1
After upgrade, validate SD-WAN control-plane stability and that management/peering functions behave normally.

If you can’t patch immediately

Reduce reachability of SD-WAN control endpoints: restrict inbound network access to only trusted management addresses/sources and approved network paths until the upgrade is completed.
Ensure temporary network restrictions are tested (so you don’t accidentally break legitimate SD-WAN operations).

Due date and guidance

CISA KEV remediation due date for this vulnerability is 2026-05-17. Follow the CISA emergency directive and hunt/hardening guidance referenced in the KEV entry.

What to monitor

Monitor for signs of suspicious peering/authentication behavior and unexpected administrative actions shortly before/after changes.
Confirm there are no follow-on alerts indicating unauthorized configuration changes to the SD-WAN fabric.

Technical context

Severity is critical (reported as 10 in the provided scoring) with an authentication bypass that has severe impact (confidentiality, integrity, and availability impact) and remote attack conditions. The weakness is categorized as CWE-287 (Improper Authentication).

Mechanism: the peering authentication mechanism in affected Cisco Catalyst SD-WAN Controller components does not properly enforce authentication. An unauthenticated remote attacker can send crafted requests to bypass authentication and obtain administrative privileges.

Successful exploitation impact path (from the findings/backstop): the attacker can access NETCONF using a high-privileged internal non-root account, then manipulate SD-WAN network configuration.

Exploitation status: this CVE is listed in CISA KEV (added 2026-05-14) and therefore treated as actively relevant. Public exploit availability is reported, and press attention is rising; however, the press finding does not provide a clear dated report of CVE-2026-20182 being exploited by itself.

Fix availability: fixed in 20.9.9.1 across the listed SD-WAN Manager/VBond/vSmart controller components.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2026-05-14.

US federal agencies must remediate by 2026-05-17.

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

92% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 83 days, from the signal feeds we watch.

2026-08-05Analysis publishedThe guardian is the gateway: 2026's exploited-bug list is a map of the security products we trusted
2026-07-24EPSS band changehigh → criticalepss band change
2026-06-25OpenVAS check added
2026-06-17Patch availablerecord updated
2026-05-25EPSS band changemoderate → high
2026-05-20Nuclei check added

Affected products

Cisco Systems Inc.commercial · USaka Cisco, cisco systems

And 2 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable