CVE-2026-20182

What is CVE-2026-20182?

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks. A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

Timeline

• 2026-05-14Published to the U.S. National Vulnerability Database (NVD)
• 2026-05-14Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
• 2026-05-15First covered in a defend.network daily briefing
• 2026-05-17CISA federal remediation deadline (BOD 22-01)
• 2026-06-17NVD record last updated

CISA Known Exploited Vulnerability

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Affected product

Cisco Catalyst SD-WAN

NVD also lists CPE entries for: Cisco Catalyst Sd-Wan Manager, Cisco Sd-Wan Vbond Orchestrator, Cisco Sd-Wan Vsmart Controller

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182
• https://nvd.nist.gov/vuln/detail/CVE-2026-20182
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Referenced in our briefings & reports

• Cisco SD-WAN zero-day exploited; TanStack supply-chain hits OpenAI (2026-05-15)

Related vulnerabilities

• CVE-2026-20245 – Cisco Catalyst SD-WAN Manager (same product)
• CVE-2026-76504 – Cisco Catalyst SD-WAN Manager (same product)
• CVE-2026-20262 – Cisco Catalyst SD-WAN Manager (same product)
• CVE-2026-76519 – Cisco Secure Email Gateway (same vendor)
• CVE-2026-76460 – Cisco Identity Services Engine (same vendor)
• CVE-2026-76461 – Cisco Secure Email Gateway (same vendor)

Cisco: 101 known exploited vulnerabilities (CISA KEV) →