CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

This vulnerability affects Cisco Catalyst SD-WAN Controller and Manager components. It allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges on an affected system. Compromise of these systems can provide control over wide-area network infrastructure, making prompt assessment essential for organizations using the product.

How it works

The weakness is categorized as CWE-287, improper authentication. An attacker can exploit the flaw to circumvent normal login requirements on the affected controller or manager.

Successful abuse grants administrative access without valid credentials. Specific mechanics of the bypass must be confirmed against the vendor advisory.

Am I affected? How to find it in your systems

Cisco Catalyst SD-WAN controllers and managers are typically deployed in enterprise network environments to manage software-defined wide area networks.

• Inventory all instances of Cisco SD-WAN Controller and Manager in your infrastructure.
• Review installed versions and configurations against the details in the vendor advisory.
• Monitor authentication logs for signs of unexpected administrative sessions or failed authentication attempts followed by successful access.

How to remediate

Apply the vendor update referenced in the official advisory as the primary remediation step.

After patching, review and strengthen authentication controls for SD-WAN management interfaces in line with general best practices for this class of vulnerability.

If you can't patch immediately

Follow CISA’s Emergency Directive 26-03 and Hunt & Hardening Guidance for Cisco SD-WAN Devices to assess and mitigate exposure.

Adhere to BOD 22-01 guidance for any cloud services involved, or discontinue use of the affected product if mitigations cannot be applied.

Additional measures include network segmentation to limit access to management interfaces and enhanced monitoring for anomalous activity.

If your data may have been exposed

Authentication bypass vulnerabilities that are actively exploited can result in unauthorized access and potential data exposure. Organizations should run a free exposure scan of their email addresses to check against known breach data.