CISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access Exploits
Summary: CISA added CVE-2026-20182, a critical authentication bypass in Cisco Catalyst SD-WAN Controller and Manager rated 10.0 on CVSS, to its KEV catalog on Thursday and set a May 17, 2026 remediation deadline for FCEB agencies. Cisco attributed active exploitation with high confidence to UAT-8616, which added SSH keys, modified NETCONF configurations, and escalated to root privileges, and said the actor's infrastructure overlaps with Operational Relay Box networks.
Why it matters: A maximum-severity flaw that lets an unauthenticated remote attacker gain administrative privileges is already being used by a named actor that escalates to root, and Cisco also observed multiple clusters exploiting CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 from March 2026, chaining them for unauthenticated access and deploying web shells such as XenShell.