Authentication Bypass in Cisco Catalyst SD-WAN Controller and Manager
CVE-2026-20182 is a critical improper authentication vulnerability in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage). The flaw is in the control-connection peering authentication/handshake implemented by the vdaemon service over DTLS on UDP/12346. Public reporting indicates the vulnerable logic is in vbond_proc_challenge_ack(), where a peer that identifies itself as a vHub (device_type = 2) can bypass the certificate and trust verification normally applied to other peer types. As a result, an unauthenticated remote attacker can complete the control-plane handshake with crafted requests, be incorrectly marked as an authenticated peer, and log in as an internal high-privileged non-root account. Cisco states that successful exploitation exposes NETCONF access, enabling manipulation of SD-WAN fabric configuration.
Impact, mitigation & remediation
What it means. What to do now. For analysts and engineers who need to decide and keep moving.
Impact
What an attacker gets — and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No valid public exploits — Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles against your asset inventory in the product.
Recent activity
180 sources tracked across advisories, community write-ups, and news. Mallory keeps watching after this page renders.
A critical authentication bypass vulnerability in Cisco Catalyst SD-WAN controllers' vdaemon service that allows a remote unauthenticated attacker to bypass certificate and trust validation during DTLS authentication by posing as a vHub device, potentially gaining trusted control-plane access and persistent privileged access.
A critical CVSS 10.0 authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller that allows an unauthenticated remote attacker to bypass authentication and gain administrative control of the network control plane.
A max-severity authentication bypass zero-day affecting Cisco Catalyst SD-WAN Controller and Manager that can let an attacker impersonate a trusted router and gain the highest level of administrative access.
A critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager caused by improper peering authentication during the control connection handshake, allowing unauthenticated remote attackers to gain administrative privileges and abuse controller functionality.
A critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager caused by a peering authentication mechanism not working properly, allowing crafted requests to log in as a high-privileged internal user and manipulate SD-WAN fabric configuration.
A critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controllers that can allow unauthenticated attackers to gain administrative privileges via improper verification of vHub components in cloud deployments.
A critical improper authentication vulnerability in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager that allows an unauthenticated remote attacker to bypass authentication and gain high-privilege access, potentially manipulating SD-WAN fabric configuration.
A Cisco Catalyst SD-WAN peering authentication vulnerability that allows a remote unauthenticated attacker to bypass login controls and gain administrative privileges.
See the full picture, correlated to your attack surface.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules — auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.