Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access
EXECUTIVE SUMMARY
Critical Auth Bypass in Cisco Catalyst SD-WAN Controller Exploited in the Wild
Summary
Cisco has issued updates to fix a critical authentication bypass vulnerability in the Catalyst SD-WAN Controller, which has been actively exploited in limited attacks. The flaw, identified as CVE-2026-20182, has a CVSS score of 10.0, indicating its maximum severity.
Key Points
- A critical authentication bypass vulnerability exists in Cisco Catalyst SD-WAN Controller.
- The vulnerability is tracked as CVE-2026-20182.
- It has a CVSS score of 10.0, reflecting its maximum severity.
- The flaw affects peering authentication in Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager.
- Cisco has confirmed that the vulnerability has been exploited in limited attacks.
- The affected product was formerly known as SD-WAN vSmart.
Analysis
The exploitation of CVE-2026-20182 in the wild underscores the critical nature of this vulnerability. With a CVSS score of 10.0, it represents a severe risk to organizations using the affected Cisco products. The active exploitation highlights the urgency for IT professionals to apply the provided patches to mitigate potential unauthorized access and control over their network infrastructure.
Conclusion
IT professionals should prioritize applying the security updates released by Cisco to address CVE-2026-20182. Ensuring that all systems are patched promptly will help prevent unauthorized access and maintain the integrity of network operations.