Loading story…
Cisco disclosed and patched CVE-2026-20182, a critical CVSS 10.0 authentication bypass flaw in Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager that has been exploited in the wild. The bug affects the vdaemon control-plane service over DTLS/UDP 12346 and allows an unauthenticated attacker to impersonate a trusted peer, gain high-privilege administrative access, reach NETCONF on TCP/830, and manipulate SD-WAN fabric configuration. Rapid7 said the flaw stems from missing authentication checks when a peer claims to be a vHub device, enabling attackers to inject SSH keys for the vmanage-admin account and establish persistent access; Cisco said there are no workarounds and released fixed software versions for affected on-premises, cloud, managed-cloud, and FedRAMP deployments.
Cisco Talos attributed the most sophisticated exploitation of CVE-2026-20182 with high confidence to UAT-8616, which was observed adding SSH keys, modifying NETCONF settings, and escalating privileges to root, with infrastructure overlap noted with Operational Relay Box networks. Talos also reported broader ongoing attacks against SD-WAN environments, including widespread exploitation of previously disclosed CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 after public proof-of-concept release, leading to deployment of JSP webshells such as XenShell, Godzilla, and Behinder, along with tools including Sliver, AdaptixC2, XMRig, gsocket, and credential-stealing scripts. CISA added CVE-2026-20182 to the KEV catalog and ordered federal agencies to remediate quickly, while Cisco and national cyber agencies urged organizations to preserve forensic evidence, review logs for unauthorized peering and vmanage-admin public-key logins, and patch all vulnerable control components immediately.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
13 events from the most recent confirmed update back to the earliest known activity.
Cisco published detailed remediation guidance instructing customers to collect admin-tech files from all control components before upgrading, then upgrade all vulnerable systems and open a TAC case for indicator scanning. The guidance also included manual verification steps and clarified that Cisco-hosted SD-WAN Cloud customers were already upgraded or scheduled for upgrades.
A ProjectDiscovery nuclei-templates pull request for CVE-2026-20182 was opened, showing public detection content was being prepared for the flaw. The visible content reflects repository workflow activity rather than exploit details.
The Canadian Centre for Cyber Security issued an alert warning of active exploitation of CVE-2026-20182. It highlighted incidents involving added SSH keys, modified NETCONF configurations, and escalation to root privileges.
CISA added CVE-2026-20182 to its Known Exploited Vulnerabilities Catalog after evidence of active exploitation. The KEV entry set a federal remediation due date of May 17, 2026.
Cisco Talos reported active in-the-wild exploitation of CVE-2026-20182 and attributed the activity to the sophisticated cluster UAT-8616. Talos said the actor attempted post-compromise actions including adding SSH keys, modifying NETCONF configurations, and escalating privileges to root.
Rapid7 disclosed that CVE-2026-20182 stems from missing authentication logic in the vdaemon service when a peer claims device type 2 (vHub). It showed attackers could become authenticated control-plane peers and append an SSH key to the vmanage-admin account for persistent NETCONF access.
Cisco published security advisories and released fixed software for CVE-2026-20182, a critical authentication bypass affecting Cisco Catalyst SD-WAN Controller and Manager. Cisco said there are no workarounds and warned the flaw had been exploited in limited attacks.
Cisco said it observed limited active exploitation of CVE-2026-20182 in May 2026, indicating the flaw was used as a zero-day before public disclosure. Reporting described attacks gaining high-privileged administrative access on SD-WAN systems.
Cisco Talos observed widespread exploitation from March to April 2026 of CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 after ZeroZenX Labs released public proof-of-concept code. Multiple threat clusters used the flaws to deploy JSP webshells and additional tooling.
Cisco had released fixes and advisories in February 2026 for Cisco SD-WAN Manager vulnerabilities CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122. Later reporting said these flaws were subsequently exploited in the wild.
Rapid7's disclosure timeline says coordinated reporting to Cisco for CVE-2026-20182 began on March 9, 2026. The vulnerability was discovered by Stephen Fewer and Jonah Burgess during research into related Cisco SD-WAN issues.
Cisco warned that two additional Cisco Catalyst SD-WAN Manager vulnerabilities, CVE-2026-20122 and CVE-2026-20128, were being actively exploited. The warning expanded the list of SD-WAN flaws known to be abused in the wild.
CISA and partner agencies released guidance about ongoing global exploitation of Cisco SD-WAN systems tied to earlier campaigns against the platform. This established the broader incident context that later reporting linked to UAT-8616 activity against Cisco SD-WAN infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
47 references tracked. Mallory keeps watching after this page renders.
cisco.com
Open sourceccb.belgium.be
Open sourceresecurity.com
Open sourcescworld.com
Open sourcecybersecuritydive.com
Open sourcecert.ssi.gouv.fr
Open sourcecisco.com
Open sourcesdxcentral.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco and multiple government cyber agencies warned that attackers are actively exploiting **CVE-2026-20127**, a critical `CVSS 10.0` authentication bypass in **Cisco Catalyst SD-WAN Controller** and **Catalyst SD-WAN Manager**. The flaw affects the peering authentication process and lets unauthenticated remote attackers gain administrative access, use `NETCONF`, and alter SD-WAN fabric configuration, including adding **malicious rogue peers**. Cisco Talos attributed the activity to a sophisticated cluster tracked as **UAT-8616**, with evidence suggesting exploitation dates back to at least 2023 and has affected high-value targets, including critical infrastructure and government networks. Investigators said the intrusions often continued with a downgrade of the appliance software to exploit **CVE-2022-20775** for **root** privilege escalation, after which the original version was restored to help conceal the compromise while maintaining persistence. In response, **CISA** added both CVEs to the **Known Exploited Vulnerabilities** catalog and issued **Emergency Directive 26-03** for U.S. federal civilian agencies, while the **UK NCSC**, **ACSC**, **Canadian Centre for Cyber Security**, and other partners released joint hunting and hardening guidance. Cisco said there are **no complete workarounds**, urged immediate upgrades to fixed releases, and advised defenders to review peering events, SSH key activity, version history, and logs for signs of tampering or unauthorized access.
Jun 29, 2026
**CISA** ordered U.S. federal civilian agencies to urgently remediate a **critical Cisco Catalyst SD-WAN Manager compromise** tied to **CVE-2026-20127**, a `CVSS 10.0` authentication bypass flaw that allows attackers to obtain high-privilege access without valid credentials. Reporting indicates the activity was uncovered by **CISA** and **Cisco Talos**, which attributed exploitation to **UAT-8616** and assessed that the intrusions date back to 2023. Attackers reportedly maintained persistence by downgrading devices to older vulnerable software and then using the access to reach `NETCONF` and manipulate SD-WAN fabric configuration, creating significant risk for federal networks and other exposed deployments. Additional research shows the campaign is not limited to a single bug. Cisco disclosed in-the-wild exploitation of **CVE-2026-20127** together with **CVE-2022-20775**, an older SD-WAN CLI flaw enabling post-auth privilege escalation and root command execution, while external analysis warned that public proof-of-concept material around `CVE-2026-20127` has been misattributed and may produce incomplete detections. Researchers also highlighted broader exposure across internet-facing SD-WAN Manager instances and warned that **CVE-2026-20133** may present underappreciated risk and could already be seeing exploitation, underscoring that defenders should treat the Cisco SD-WAN issue as an active intrusion and hardening priority rather than a routine patch cycle.
Jun 29, 2026
Attackers have actively exploited multiple vulnerabilities in **Cisco Catalyst SD-WAN Manager** (`vManage`) to bypass authentication, escalate privileges to **root**, and alter downstream network infrastructure. Reporting on the campaign says the intrusion chain used critical auth-bypass flaws `CVE-2026-20127` and `CVE-2026-20182` for initial access, then leveraged `CVE-2026-20245` to execute commands as root through crafted file upload and command injection in the CLI. Cisco confirmed limited incidents in which exploitation led to configuration changes being pushed to edge devices, raising the risk that compromise of a single controller could affect broad SD-WAN environments. Cisco also disclosed active exploitation of `CVE-2026-20262`, a separate zero-day in Cisco Catalyst SD-WAN Manager that lets an authenticated low-privilege attacker abuse file-upload handling to create or overwrite files on the underlying operating system and gain root privileges. The flaw affects on-premises, Cloud, Cloud-Pro, and FedRAMP deployments, and Cisco released fixes in versions `20.9.9.2`, `20.12.7.2`, `20.15.4.5`, `20.15.5.3`, `20.18.3.1`, and `26.1.1.2`. U.S. authorities added exploited Cisco SD-WAN flaws to the **Known Exploited Vulnerabilities** catalog, and CISA issued **Emergency Directive 26-03** directing federal agencies to hunt for compromise and rapidly harden affected systems.
Jul 7, 2026