CVE-2026-20182
Published: 14 May 2026
Summary
CVE-2026-20182 is a critical-severity Improper Authentication (CWE-287) vulnerability in Cisco Catalyst Sd-Wan Manager. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-3 (Device Identification and Authentication).
Deeper analysis
A vulnerability in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated remote attacker to bypass authentication. The flaw stems from improper operation of the control connection handshaking process and carries a CVSS score of 10.0 under CWE-287. It was disclosed and fixed after an earlier February 2026 advisory, with the current notice supplying Show Control Connections guidance for verification.
An attacker can exploit the issue by sending crafted requests to the affected system, enabling login as an internal high-privileged non-root account. From that position the attacker gains access to NETCONF and can alter SD-WAN fabric configuration.
Cisco security advisories at the referenced URLs detail the fix and include system-check procedures; the vulnerability also appears in the CISA Known Exploited Vulnerabilities catalog. The associated EPSS score stands at 0.8384 with an identical peak value, indicating sustained high exploitation probability since disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-30324
Vulnerability details
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The…
more
section of this advisory includes Show Control Connections guidance to help with system checks. A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
- CWE(s)
- KEV Date Added
- 14 May 2026
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated auth bypass on public-facing SD-WAN controller/manager enables direct exploitation of the exposed application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authentication decisions during control-connection handshaking, blocking the crafted-request bypass that grants high-privileged NETCONF access.
Requires cryptographic or mutual device authentication for SD-WAN peering sessions, directly mitigating the flawed vSmart/vManage/vBond handshaking mechanism.
Mandates identification and authentication of organizational users before allowing administrative sessions, limiting the impact of any authentication bypass on the affected controllers.