What it is
CVE-2026-20182 is an unauthenticated Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability. May 2026: This security advisory provides the details and fix information for a vulnerability that was...
Vulnerability report
Exploited in the wild
Confirmed confidence
In CISA KEV
CVE-2026-20182
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Cisco Catalyst SD-WAN Controller · 20.6.4
- Severity
- CVSS 10.0 · Critical
- Confidence
- Confirmed
- Exploit status
- Exploited in the wild
- EPSS
- 91.5%
- First observed
- —
- Last observed
- —
Decision summary
What security teams need to know first
Direct answers before the deeper technical record.
Is it exploited?
Yes. Previdian tracks this CVE as a known exploited vulnerability. Confidence is confirmed. Listed in CISA KEV. Also confirmed by third-party sources.
Who is affected?
Cisco Catalyst SD-WAN Controller 20.6.4.
What should we do?
Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Overview
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks. A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly.
An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
Vendor
Product
Affected
Status
Cisco
Affected
Cisco Catalyst SD-WAN Controller
20.6.4
20.9.2
20.3.6
20.7.2
20.7.1
20.5.1
20.6.2
19.3.0
20.6.1
17.2.4
18.2.0
18.4.6
19.1.0
19.2.4
19.2.929
18.3.8
18.4.303
18.3.7
18.4.1
19.2.097
19.2.0
19.2.099
18.3.6
20.4.2
19.0.0
20.9.1
20.3.5
20.3.1
18.3.5
20.6.3
18.4.3
18.4.4
18.3.3
17.2.8
20.8.1
19.2.32
19.2.2
17.2.5
18.4.0
20.4.1.1
20.1.3
20.1.2
17.2.10
19.2.098
20.1.1
17.2.6
19.2.1
18.3.4
20.4.1
17.2.9
19.2.31
19.0.1a
18.3.0
17.2.7
18.4.5
20.3.4
20.3.3
20.4.1.2
20.3.2
18.3.1
20.1.12
19.2.3
20.10.1
20.6.5
20.3.7
20.9.3
20.11.1
20.6.3.2
20.4.2.3
20.3.5.1
20.3.4.3
20.9.3.1
20.6.4.1
20.3.3.2
20.6.5.2
20.3.7.1
20.11.1.1
20.10.1.1
20.6.1.2
20.1.3.1
20.9.2.2
20.6.5.3
20.6.3.3
20.3.7.2
20.6.5.4
20.9.2.3
20.9.4
20.12.1
20.3.8
20.6.6
20.12.2
20.13.1
20.9.5
20.12.3
20.6.7
20.9.5.1
20.14.1
20.12.3.1
20.12.4
20.15.1
20.9.6
20.6.8
20.16.1
20.9.5.3
20.12.4.1
20.15.2
20.12.5
20.9.7
20.15.3
20.12.5.1
20.12.5.2
20.15.4
20.9.7.1
20.12.6
20.9.8
20.15.4.1
20.15.4.2
20.12.5.3
20.12.6.1
20.9.8.2
20.15.5
20.12.7
20.9.9
20.15.5.1
20.15.4.3
20.15.4.5
20.15.5.3
20.12.7.2
20.9.9.2
Affected
Cisco
Affected
Cisco Catalyst SD-WAN Manager
20.1.12
19.2.1
18.4.4
18.4.5
20.1.1.1
20.1.1
19.2.099
18.3.6
18.3.7
19.2.0
19.1.0
18.4.303
19.2.098
18.3.6.1
18.2.0
17.2.8
18.3.3.1
18.4.0
18.3.1
17.2.6
17.2.9
17.2.5
18.4.0.1
18.3.3
18.3.0
19.2.3
18.4.501_ES
20.1.2
19.2.929
19.2.31
20.3.2
19.2.4
19.2.4.0.9
20.1.3.1
Affected
- Published
- 14 May 2026
- Exploitation Reported
- 01 Jun 2026
- Attack vector
- Remote
- Complexity
- Low
- Privileges
- None
- User interaction
- None
Tags
edge
cisa
CVE References
- CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-20182
- cisco-sa-sdwan-rpa2-v69WY2SW sec.cloudapps.cisco.com · CVE Record https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurity...
- Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability</a> was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The <a href="#IOC">Indicators of Compromise sec.cloudapps.cisco.com · CVE Record https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurity...
Exploitation evidence
Why Previdian marks this CVE as exploited
Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.
Exploited in the wild
CVE
A trusted third party reported exploitation.
Known exploited vulnerability sources
Per-source evidence links for KEV attestations are available through the Previdian Pro API.
Learn about Pro API access| Source | Added |
|---|---|
| CVE First | 2026-06-01 10:28 UTC |
| CISA | 2026-06-02 14:01 UTC |
| Google Threat Intelligence | 2026-06-24 14:20 UTC |
Detection
Operational artifacts and observed signals
Make the evidence actionable in scanner, SOC, and edge-control workflows.
Observed signals
- Request targets
- User-Agents
- Callback hosts
- 0
- 0
- 0
Request targets and User-Agents available in Pro. Callback host details available in Enterprise.
Scanner coverage
No scanner integrations recorded yet.
Virtual patch status
No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.
Learn about virtual patches →No detection artifacts or sensor request patterns are available for this CVE yet.
Check back as sensor telemetry and scanner integrations are updated.
Risk and context
Severity, weaknesses, and research context
CVSS v3.1
10.0
Critical
Potential damage if exploited. Separate from whether attackers are using it.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS
91.5%
Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.
Weaknesses
Recent mention · Rapid7
Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)
OverviewOn September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding...
Read full advisoryAll Mentions
Recent mention · Rapid7
Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)Rapid7 · 30 Sep 2026
OverviewOn September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding (CWE-177). An unauthenticated, remote attacker can send a crafted HTTP request that bypasses an authentication rule for a specific API endpoint, gaining access to the API with the privileges of the admin user.According to Cisco, CVE-2026-76504 is being actively exploited in the wild; Cisco PSIRT became aware of the...
Recent mention · The Hacker News
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN ManagerThe Hacker News · 30 Sep 2026
Swati KhandelwalSep 30, 2026Vulnerability / Network Security Attackers are exploiting a critical flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30. The flaw, CVE-2026-76504, could allow a remote attacker with no login access to use the Manager's API as the admin user. Fixed releases are available, and there is no workaround. CVE-2026-76504 carries a CVSS score of 9.8 out of 10. It sits in the part of the Manager's API that handles login sessions. The Manager mishandles URI encoding in an HTTP...
Recent mention · Google Threat Intelligence
Written by: Chester Sng, Pete Boonyakarn, Logeswaran Nadarajan Introduction In early 2026, Mandiant identified a threat actor targeting SD-WAN...Google Threat Intelligence · 24 Jun 2026
Written by: Chester Sng, Pete Boonyakarn, Logeswaran Nadarajan Introduction In early 2026, Mandiant identified a threat actor targeting SD-WAN infrastructure at a service provider. After gaining initial access, the threat actor exploited a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access. The vulnerability stems from the device’s file upload feature lacking the ability to properly filter malicious data. Throughout the intrusion, to maintain operational security and avoid detection, the...
Recent mention · Google Threat Intelligence
Written by: Chester Sng, Pete Boonyakarn, Logeswaran Nadarajan, Lukasz Lamparski Introduction In early 2026, Mandiant identified a threat actor...Google Threat Intelligence · 24 Jun 2026
Written by: Chester Sng, Pete Boonyakarn, Logeswaran Nadarajan, Lukasz Lamparski Introduction In early 2026, Mandiant identified a threat actor targeting SD-WAN infrastructure at a service provider. After gaining initial access, the threat actor exploited a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access. The vulnerability stems from the device’s file upload feature lacking the ability to properly filter malicious data. Throughout the intrusion, to maintain operational security and avoid...
Recent mention · Cisco Security Advisory
Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation VulnerabilityCisco Security Advisory · 09 Jun 2026
A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection...
Recent mention · Cisco Security Advisory
Cisco Catalyst SD-WAN Manager Authenticated Privilege Escalation VulnerabilityCisco Security Advisory · 04 Jun 2026
A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker...
Recent mention · Cisco Security Advisory
Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCisco Security Advisory · 27 May 2026
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The Indicators of Compromise section of this advisory includes Show Control Connections guidance to help with system checks. A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager,...
Timeline
From disclosure to observed exploitation
-
14:20 UTC
KEV confirmed by Google Threat Intelligence
Exploitation attested by an external source
-
14:01 UTC
Added to CISA KEV
Listed in the CISA Known Exploited Vulnerabilities catalog
-
10:28 UTC
Added to Previdian KEV Feed
High-confidence, third-party attested exploitation
-
16:08 UTC
CVE published
Vulnerability disclosed publicly
-
11:59 UTC
CVE ID reserved
Identifier reserved by the CNA
Pro API
Automate this intelligence
Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.
- Evidence confidence and provenance
- First-party sensor telemetry
- PoC and scanner references
- Affected versions and enrichment
- Automation-ready JSON delivery
GET /api/v2/pro/kevs/CVE-2026-20182
Free JSON includes basic KEV fields{
"cve_id": "CVE-2026-20182",
"confidence": "Confirmed",
"cvss_score": 10.0,
"cvss_estimated": false,
"epss_score": 0.91522,
"exploit_status": {
"exploited_in_the_wild": true,
"active_exploitation_observed": false
},
"sensor_telemetry": { "attempts": 0, "sensors": 0 }
}