Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access

Cisco released updates for CVE-2026-20182, a critical authentication bypass vulnerability (CVSS 10.0) in Catalyst SD-WAN Controller that is actively being exploited.

• •CVE-2026-20182 affects the vdaemon service over DTLS (UDP port 12346), allowing unauthenticated remote attackers to bypass authentication
• •Successful exploitation allows attackers to log in as a high-privileged vmanage-admin account and access NETCONF
• •Attackers can manipulate network configuration for the SD-WAN fabric
• •The vulnerability is similar to CVE-2026-20127 (CVSS 10.0), another authentication bypass in the same component exploited since 2023
• •Limited exploitation was confirmed in May 2026; Cisco urges immediate patching for internet-exposed systems