Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access
Summary: Cisco released updates for CVE-2026-20182, a maximum-severity authentication bypass in Catalyst SD-WAN Controller and Manager with a CVSS score of 10.0, caused by a malfunction in the peering authentication mechanism that lets an unauthenticated remote attacker send crafted requests and log in as a high-privileged non-root user. Cisco said it became aware of limited exploitation in May 2026, and Rapid7, which discovered the flaw, said it affects the vdaemon service over DTLS on UDP port 12346 and is a different issue from CVE-2026-20127, which threat actor UAT-8616 has exploited since at least 2023.
What you should know: A successful exploit gives an attacker NETCONF access to manipulate configuration across the SD-WAN fabric, and Cisco notes that internet-accessible controllers with exposed ports face increased risk. UAT-8616 has been working the same vdaemon service since at least 2023, so the question is whether your auth.log shows Accepted publickey entries for vmanage-admin from addresses you do not recognize.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-20127CVE-2026-20182
- Related