CVE-2026-20182 is an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart) and Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage). It allows a remote attacker to gain administrative privileges by sending specially crafted packets that exploit weaknesses in the peering authentication mechanism. The vulnerability has been exploited in limited targeted attacks by the sophisticated threat actor UAT-8616, who has used it to add SSH keys, modify NETCONF configurations, and escalate to root privileges. Cisco was notified by Rapid7, which discovered the flaw during analysis of a related vulnerability (CVE-2026-20127). Cisco has released patches to address this issue and provided indicators of compromise to aid detection. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a three-day remediation deadline for federal agencies. This is the sixth SD-WAN zero-day exploited in 2026, underscoring persistent threats to Cisco SD-WAN infrastructure.

Successful exploitation of CVE-2026-20182 allows remote attackers to bypass authentication and gain administrative privileges on affected Cisco SD-WAN systems. This enables attackers to perform unauthorized actions such as adding SSH keys, modifying network configurations, and escalating privileges to root level. The vulnerability has been actively exploited in targeted attacks by a highly sophisticated threat actor, indicating real-world risk. Compromise of SD-WAN controllers can lead to significant network control and potential deployment of malware such as cryptocurrency miners, credential stealers, backdoors, and webshells as observed in related activity clusters.

Cisco has released official patches for CVE-2026-20182. Organizations using affected Cisco Catalyst SD-WAN Controller and Manager versions should apply these patches immediately. Cisco has also provided indicators of compromise to assist in detecting exploitation attempts. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included this vulnerability in its Known Exploited Vulnerabilities catalog with a three-day remediation deadline for federal agencies. There is no indication that the vulnerability is mitigated without patching, so timely application of Cisco's official fix is strongly recommended.