CISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access Exploits

CISA added CVE-2026-20182, a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller rated 10.0 CVSS, to its Known Exploited Vulnerabilities catalog requiring federal remediation by May 17, 2026.

• •Threat cluster UAT-8616 actively exploits the flaw to gain administrative privileges and perform post-compromise actions including SSH key injection and privilege escalation
• •At least 10 different threat clusters exploit chained vulnerabilities to gain unauthorized device access
• •Attackers deploy web shells (Godzilla, Behinder, XenShell) and C2 frameworks (Sliver, AdaptixC2) via publicly available PoC exploit code
• •Secondary payloads target credential theft including admin hashdumps, JWT key chunks, and AWS credentials for vManage access

This summary was automatically generated by AI based on the original article and may not be fully accurate.