Cisco Warns of Critical SD-WAN Flaw Actively Exploited in Zero-Days
Cisco disclosed that CVE-2026-20182, a critical authentication bypass in its Catalyst SD-WAN Controller and Manager, is being actively exploited in zero-day attacks allowing high-privileged access and network configuration manipulation. CISA has added the flaw to its Known Exploited Vulnerabilities Catalog with a patching deadline of May 17, 2026 for federal agencies while Cisco released updates but no full workarounds.
In an advisory published today, Cisco said the issue stems from a peering authentication mechanism that is not working properly. The advisory states, "This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system." A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
Cisco Catalyst SD-WAN is a software-based networking platform that connects branch offices, data centers, and cloud environments through a centrally managed system. It uses a controller to securely route traffic between sites over encrypted connections.
The company says it detected threat actors exploiting the flaw in May, but did not share any details regarding how it was exploited. Shared indicators of compromise warn admins to check for unauthorized peering events in the SD-WAN Controller logs, which could indicate attempts to register rogue devices within the SD-WAN fabric. By adding a rogue peer, an attacker could insert a malicious device into the SD-WAN environment that appears legitimate. That device could then establish encrypted connections and advertise networks under the attacker's control, potentially allowing them to move deeper into an organization's network.
The flaw was discovered by Rapid7 while researching a different Cisco SD-WAN controller vulnerability, tracked as CVE-2026-20127, which was fixed in February. CVE-2026-20127 was also exploited in zero-day attacks by a threat actor tracked as "UAT-8616" since 2023 to create rogue peers in organizations.
Cisco has released security updates to address the vulnerability and says there are no workarounds that fully mitigate the issue. The company also recommends restricting access to SD-WAN management and control-plane interfaces to trusted internal networks or to authorized IP addresses only, and reviewing authentication logs for suspicious login activity.
CISA has added the Cisco CVE-2026-20182 flaw to the Known Exploited Vulnerabilities Catalog, ordering federal agencies to patch affected devices by May 17, 2026. Cisco is urging organizations to review logs from any internet-exposed Catalyst SD-WAN Controller systems for events that may indicate unauthorized access or peering events. The company says that admins should review /var/log/auth.log for entries showing "Accepted publickey for vmanage-admin" from unknown IP addresses. Administrators should compare IP addresses in logs with the configured System IPs listed in the Cisco Catalyst SD-WAN Manager web UI, under WebUI > Devices > System IP. If an unknown IP address successfully authenticated, administrators should consider the device to be compromised and open a Cisco TAC case. Cisco also recommends reviewing SD-WAN Controller logs for unauthorized peering activity.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
EXPERT TAKE
Administrators should review /var/log/auth.log for "Accepted publickey for vmanage-admin" entries from unknown IPs not matching configured System IPs and restrict management interface access to trusted networks per Cisco's guidance.