CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks. A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
How it works
The weakness is categorized as CWE-287, improper authentication. An attacker can exploit the flaw to circumvent normal login requirements on the affected controller or manager.
Successful abuse grants administrative access without valid credentials. Specific mechanics of the bypass must be confirmed against the vendor advisory.
Am I affected? How to find it in your systems
Cisco Catalyst SD-WAN controllers and managers are typically deployed in enterprise network environments to manage software-defined wide area networks.
- Inventory all instances of Cisco SD-WAN Controller and Manager in your infrastructure.
- Review installed versions and configurations against the details in the vendor advisory.
- Monitor authentication logs for signs of unexpected administrative sessions or failed authentication attempts followed by successful access.
How to remediate
Apply the vendor update referenced in the official advisory as the primary remediation step.
After patching, review and strengthen authentication controls for SD-WAN management interfaces in line with general best practices for this class of vulnerability.
If you can't patch immediately
Follow CISA’s Emergency Directive 26-03 and Hunt & Hardening Guidance for Cisco SD-WAN Devices to assess and mitigate exposure.
Adhere to BOD 22-01 guidance for any cloud services involved, or discontinue use of the affected product if mitigations cannot be applied.
Additional measures include network segmentation to limit access to management interfaces and enhanced monitoring for anomalous activity.
If your data may have been exposed
Authentication bypass vulnerabilities that are actively exploited can result in unauthorized access and potential data exposure. Organizations should run a free exposure scan of their email addresses to check against known breach data.
AICompiled with AI assistance from public sources and published under our editorial standards.
Details
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H