Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access

Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access Ravie LakshmananMay 14, 2026Vulnerability / Network Security Cisco has released updates to address a maximum-severity authentication bypass flaw in Catalyst SD-WAN Controller that it said has been exploited in limited attacks. The vulnerability, tracked as CVE-2026-20182, carries a CVSS score of 10.0. "A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system," Cisco said. The networking equipment major said the flaw stems from a malfunction of the peering authentication mechanism, which an attacker could exploit by sending crafted requests to the affected system. A successful exploit could permit the attacker to log in to the Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account, and then weaponize it to access NETCONF and manipulate network configuration for the SD-WAN fabric.. The vulnerability impacts the following deployments - On-Prem Deployment Cisco SD-WAN Cloud-Pro Cisco SD-WAN Cloud (Cisco Managed) Cisco SD-WAN for Government (FedRAMP) According to Rapid7, which discovered CVE-2026-20182, the shortcoming has its echoes in CVE-2026-20127 (CVSS score: 10.0), another critical authentication bypass impacting the same component. The latter is said to have been exploited by a threat actor called UAT-8616 since at least 2023. "This new authentication bypass vulnerability affects the 'vdaemon' service over DTLS (UDP port 12346), which is the same service that was vulnerable to CVE-2026-20127," Rapid7 researchers Jonah Burgess and Stephen Fewer said. "The new vulnerability is not a patch bypass of CVE-2026-20127. It is a different issue located in a similar part of the 'vdaemon' networking stack." That said, the end result is the same: a remote unauthenticated attacker can abuse CVE-2026-20182 to become an authenticated peer of the target appliance and carry out privileged operations. Cisco, in its advisory, noted that it became aware of "limited exploitation" of the flaw in May 2026, urging customers to apply the latest updates as soon as possible. The company also said Catalyst SD-WAN Controller systems that are accessible over the internet and that have ports exposed are at increased risk of compromise. It's recommending customers to audit the "/var/log/auth.log" file for entries related to Accepted publickey for vmanage-admin from unknown or unauthorized IP addresses. Another indicator is the presence of suspicious peering events in the logs, including unauthorized peer connections that occur at unexpected times and originate from unrecognized IP addresses, or involve device types that are inconsistent with the environment's architecture. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  Authentication bypass, cisco, cybersecurity, NETCONF, network security, Patch Management, rapid7, Vulnerability ⚡ Top Stories This Week ⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE and More Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution New Linux PamDOORa Backdoor Uses PAM Modules to Steal SSH Credentials The Hacker News Launches 'Cybersecurity Stars Awards 2026' — Submissions Now Open Day Zero Readiness: The Operational Gaps That Break Incident Response PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage ThreatsDay Bulletin: Edge Plaintext Passwords, ICS 0-Days, Patch-or-Die Alerts and 25+ New Stories Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries We Scanned 1 Million Exposed AI Services. Here's How Bad the Security Actually Is Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions 2026: The Year of AI-Assisted Attacks 30,000 Facebook Accounts Hacked via Google AppSheet Phishing Campaign Trellix Confirms Source Code Breach With Unauthorized Repository Access Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE Load More ▼ ⭐ Featured Resources [Guide] Get Practical AI SOC Insights to Improve Threat Detection [Webinar] Learn How Autonomous Validation Keeps Pace With AI Attacks [Demo] Discover How to Control Autonomous Identity Risks Effectively [Demo] Stop Email Attacks and Protect Cloud Workspace Data Faster