Cisco Catalyst SD-WAN Controller Authentication Bypass (CVE-2026-20182)

Historical catalog analysis: CISA added this entry on May 14, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-20182 is an authentication bypass vulnerability (CWE-287) affecting the Cisco Catalyst SD-WAN Controller and Manager. The flaw allows an unauthenticated, remote attacker to circumvent authentication mechanisms and gain administrative privileges on the affected system.

Exposure and applicability

This vulnerability applies to organizations deploying Cisco Catalyst SD-WAN infrastructure where the Controller or Manager components are accessible via the network. Because the exploit path is remote and requires no prior credentials, any exposed management interface for these specific products represents a high-risk entry point for unauthorized administrative access.

Remediation priorities

Based on the reported vulnerability, we analyze the following priority actions for vulnerability management teams:

1. Immediate Exposure Assessment: Identify all instances of Cisco Catalyst SD-WAN Controller and Manager within the environment. This is the primary step to determine the scope of the attack surface.
2. Implementation of CISA Emergency Directive 26-03: Apply the specific mitigation steps outlined in ED 26-03. For cloud-based deployments, these actions should be aligned with BOD 22-01 guidance.
3. Hardening and Hunt Operations: Execute the “Hunt & Hardening Guidance for Cisco SD-WAN Devices” provided by CISA to identify potential indicators of compromise and reduce the overall attack surface beyond simple patching.
4. Service Decommissioning: In scenarios where mitigations cannot be applied or verified, the source suggests discontinuing use of the product to eliminate the risk.

How to validate remediation

Verification must move beyond a version check, as software updates alone do not guarantee that the system is hardened against this specific bypass or that previous unauthorized access has been cleared.

Defenders should verify remediation by:
* Cross-referencing Configuration: Validating that the specific hardening steps detailed in CISA’s supplemental guidance have been applied to the device configuration.
* Hunt Results: Reviewing logs and system state as prescribed in the Hunt & Hardening Guidance to ensure no administrative accounts were created or modified via the bypass prior to remediation.
* Access Control Validation: Confirming that remote administrative access is restricted to authorized networks, reducing the likelihood of remote exploitation even if a vulnerability persists.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Additionally, while CISA provided a strict deadline for federal agencies (2026-05-17), non-federal organizations must determine their own risk appetite and patching cadence based on their specific exposure.

Residual risk persists if the “Hunt” phase is skipped; applying a fix to a system that has already been compromised via authentication bypass does not remove the attacker’s established administrative access.

Source and editorial note

CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability · Source date: May 14, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: May 17, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 11, 2026 at 00:47 UTC.

Request a Vulnerability Assessment