Full Report
The U.S.Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a newly disclosed vulnerability impacting Cisco Catalyst SD-WAN Controller to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate the issue by May 17, 2026. The vulnerability is a critical authentication bypass tracked as CVE-2026-20182. It's
Analysis Summary
# Vulnerability: Cisco Catalyst SD-WAN Controller Authentication Bypass
## CVE Details
- **CVE ID:** CVE-2026-20182
- **CVSS Score:** 10.0 (Critical)
- **CWE:** Authentication Bypass (Specific CWE not provided in text, likely CWE-287)
## Affected Systems
- **Products:** Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager (formerly vManage).
- **Versions:** Specific version numbers not listed in the article; refer to Cisco's official advisory for the full version matrix.
- **Configurations:** Systems running the SD-WAN Controller/Manager interface accessible via the network.
## Vulnerability Description
CVE-2026-20182 is a critical authentication bypass vulnerability. It allows an unauthenticated, remote attacker to circumvent standard security protocols and gain unauthorized access to the management interface. Successful exploitation grants the attacker full administrative privileges, effectively providing total control over the SD-WAN fabric and its orchestrated components.
## Exploitation
- **Status:** Exploited in the wild (Added to CISA KEV on May 14, 2026).
- **Complexity:** Low (Public PoC code for related SD-WAN flaws is currently being leveraged by threat actors).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** Total (Access to all configurations, credentials, and data).
- **Integrity:** Total (Ability to modify NETCONF configurations and add SSH keys).
- **Availability:** Total (Potential to disrupt SD-WAN operations or brick controllers).
## Remediation
### Patches
- Cisco has released software updates to address this flaw. Users are urged to migrate to fixed releases immediately. (Consult Cisco Advisory for specific build numbers).
### Workarounds
- The article does not list specific functional workarounds. Standard hardening includes restricting access to management interfaces (vManage/Controller) to trusted IP ranges or via VPN/OOB management only.
## Detection
- **Indicators of Compromise:**
- Unauthorized SSH keys added to the system.
- Presence of JSP-based web shells (e.g., XenShell, Godzilla, Behinder).
- Modification of NETCONF configurations.
- Evidence of credential theft (attempts to dump admin hashes, JWT key chunks, or AWS credentials).
- Network traffic to known Operational Relay Box (ORB) networks.
- **Detection methods and tools:**
- Monitor for unauthorized administrative logins.
- Use Cisco Talos intelligence to cross-reference activity with threat actor **UAT-8616**.
- Scan for file integrity changes on the SD-WAN Manager filesystem.
## References
- Cisco Talos Blog: hxxps[://]blog[.]talosintelligence[.]com/sd-wan-ongoing-exploitation/
- CISA KEV Catalog: hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- The Hacker News Article: hxxps[://]thehackernews[.]com/2026/05/cisa-adds-cisco-sd-wan-cve-2026-20182[.]html