Cisco SD-WAN CVE-2026-20182: CVSS 10.0 Auth Bypass Actively Exploited — CISA Issues Emergency Directive 26-03

A new critical vulnerability in Cisco’s enterprise networking infrastructure is being actively exploited in the wild — and the numbers are alarming. CVE-2026-20182 is a CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller and SD-WAN Manager that allows unauthenticated, remote attackers to gain full administrative access to affected systems. The US Cybersecurity and Infrastructure Security Agency has issued Emergency Directive 26-03, giving federal agencies just three days to patch. If you’re running Cisco SD-WAN in your environment, this needs to move to the top of your priority list immediately.

CVE-2026-20182 is the second critical authentication bypass to hit Cisco Catalyst SD-WAN products in 2026, following CVE-2026-20127. While Cisco has confirmed that CVE-2026-20182 is not a patch bypass of the earlier flaw — it’s an entirely new vulnerability in the same service — the back-to-back critical vulnerabilities in the same product family is causing significant alarm in enterprise security teams. As we’ve seen with other zero-day clusters in 2026, once attackers identify a product family as vulnerable, they systematically hunt for additional flaws.

What Is CVE-2026-20182?

CVE-2026-20182 is classified under CWE-287 (Improper Authentication) and carries a CVSSv3.1 base score of 10.0 — the maximum possible severity rating. A CVSS 10.0 vulnerability is extraordinarily rare; it indicates a flaw that is remotely exploitable, requires no authentication, has no complexity requirements, needs no user interaction, and results in complete compromise of confidentiality, integrity, and availability.

The vulnerability affects the “vdaemon” service that runs in Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart) and Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage). This service is responsible for SD-WAN peer authentication and runs over DTLS on UDP port 12346. The flaw exists in how vdaemon validates authentication requests during the peering handshake, allowing attackers to send malformed requests that bypass the authentication entirely and gain administrative privileges.

What makes this particularly dangerous is that the vdaemon service is often internet-exposed in SD-WAN deployments — it needs to be reachable for legitimate SD-WAN peering to function. That means there’s no firewall workaround that doesn’t break SD-WAN functionality: you either patch, or you remain vulnerable while internet-exposed.

Technical Details: How the CVE-2026-20182 Attack Works

According to Rapid7’s analysis and Cisco Talos intelligence, the attack against CVE-2026-20182 follows a specific sequence. Attackers identify internet-facing Cisco SD-WAN Controller or Manager instances — a trivial task with Shodan or similar tools — and send crafted DTLS packets to UDP port 12346 that exploit the authentication bypass. Once administrative access is obtained, post-exploitation activities observed in the wild include:

• SSH key injection: Adding attacker-controlled SSH keys to the system for persistent remote access
• NETCONF modification: Altering network configuration to redirect traffic or create backdoor routing rules
• Root privilege escalation: Moving from administrative to root-level access
• Lateral movement: Using the SD-WAN controller as a pivot point into the broader enterprise network
• Data exfiltration setup: Creating persistent tunnels for long-term data access

The fact that attackers are adding SSH keys rather than simply running commands suggests this isn’t opportunistic exploitation — it’s persistent, targeted, and likely the first stage of a longer intrusion campaign. SD-WAN controllers sit at the heart of enterprise network architectures; anyone with admin access to the SD-WAN controller has visibility into — and in many cases control over — traffic flows across the entire organization.

Active Exploitation: Who Is UAT-8616?

Cisco Talos tracks the threat group exploiting CVE-2026-20182 as UAT-8616. Talos clusters this activity with high confidence, noting that UAT-8616 specifically targeted internet-exposed Cisco Catalyst SD-WAN systems beginning in early May 2026. Talos has not attributed UAT-8616 to a specific nation-state, but the group’s targeting of enterprise network infrastructure and the persistence-focused post-exploitation behavior is consistent with nation-state or sophisticated financially-motivated APT actors.

The group’s targeting is selective rather than opportunistic. Talos has observed UAT-8616 prioritizing SD-WAN instances belonging to telecommunications companies, financial services firms, government contractors, and healthcare organizations — exactly the sectors where SD-WAN infrastructure would provide the greatest intelligence or extortion value.

This targeting profile fits the broader pattern of 2026 attacks we’ve been tracking. Mandiant’s M-Trends 2026 report documented how sophisticated threat actors are increasingly targeting network infrastructure rather than endpoints — because compromise of a router, switch, or SD-WAN controller gives access to everything that flows through it without leaving traditional endpoint artifacts that security tools would catch.

CISA Emergency Directive 26-03: What It Means

CISA’s Emergency Directive 26-03, issued in response to confirmed active exploitation of CVE-2026-20182, is not a recommendation — it’s a mandate for federal civilian executive branch agencies. The directive gives agencies 72 hours to either patch affected Cisco SD-WAN systems or document why patching within the timeframe is technically infeasible and implement compensating controls.

Emergency Directives are among CISA’s most serious tools. They’re issued only for vulnerabilities with confirmed, active exploitation that pose significant risk to federal systems. In 2026, CISA has issued only three Emergency Directives — CVE-2026-20182 is the third, which tells you everything about how seriously the agency views this vulnerability.

For private sector organizations, Emergency Directives are not legally binding — but they serve as the strongest possible signal from the US government about what constitutes an unacceptable security risk. When CISA issues an Emergency Directive, private sector CISOs should treat it as equivalent guidance unless there is a specific operational reason not to. Insurance carriers and regulators have increasingly been looking to CISA Emergency Directives as baseline security expectations.

Affected Systems and Versions

CVE-2026-20182 affects Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager (vManage). According to Cisco’s security advisory, the following software versions are vulnerable:

• SD-WAN Controller releases prior to 20.12.4
• SD-WAN Manager (vManage) releases prior to 20.12.4
• SD-WAN Controller releases in the 20.9 train prior to the designated fixed release
• SD-WAN Controller releases in the 20.6 train prior to the designated fixed release

Cisco has confirmed that Cisco IOS XE SD-WAN features, Cisco Catalyst 8000 Series Edge Platforms, and the Cisco vEdge Cloud Router are not affected by CVE-2026-20182. However, organizations running any version of the Controller or vManage software in the affected ranges should assume they are vulnerable until patched.

Tenable has added detection for CVE-2026-20182 to Nessus, and Qualys and Rapid7 are shipping plugins shortly. If you’re running a vulnerability scanner in your environment, update your plugin sets immediately and run an authenticated scan against your SD-WAN infrastructure.

How to Respond to CVE-2026-20182 Right Now

The response to CVE-2026-20182 is straightforward but requires immediate action. Here’s what security teams should do in order of priority:

1. Identify all affected instances. Run a complete inventory of Cisco Catalyst SD-WAN Controller and Manager deployments across your environment. Check software version numbers against Cisco’s advisory. Don’t assume your team knows about every SD-WAN instance — acquired subsidiaries and shadow IT are common sources of unmanaged exposure.

2. Apply Cisco’s patches immediately. Upgrade to SD-WAN Controller and vManage version 20.12.4 or later. Cisco has released hotfixes for older software trains. Check Cisco’s security advisory at cisco.com for the specific fixed release for your software version.

3. Review logs for indicators of compromise. Cisco strongly recommends reviewing logs for any internet-exposed Catalyst SD-WAN Controller systems. Look for: unusual SSH key additions, unexpected NETCONF configuration changes, administrative logins from unfamiliar source IPs, and unexpected peering events. If you find evidence of compromise, this is an active incident — engage your incident response team and consider engaging Talos or another DFIR provider.

4. Restrict UDP 12346 exposure. Where operationally possible, restrict access to the vdaemon service (UDP port 12346) to known, trusted IP ranges. This won’t fully mitigate the vulnerability — it’s not a substitute for patching — but it reduces the attack surface during the patching window.

The combination of a perfect CVSS score, active exploitation, and a CISA Emergency Directive makes CVE-2026-20182 one of the most urgent security issues of 2026. Don’t wait for your next patch cycle.

Sources: The Hacker News | Rapid7 | Cisco Security Advisory | Talos Intelligence | BleepingComputer | Tenable