Is CVE-2026-20182 exploited in the wild?

Yes. CVE-2026-20182 is known to be exploited in the wild, first recorded on 14 May 2026. Treat it as urgent.

How severe is CVE-2026-20182?

Critical severity, with a CVSS score of 10, published 14 May 2026.

Which products and versions are affected?

Cisco Catalyst SD-WAN Controller (vSmart); Cisco Catalyst SD-WAN Manager (vManage); Cisco Catalyst SD-WAN Validator (vBond).

Is there a fix for CVE-2026-20182?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-20182 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-20182?

Check whether you run Cisco Catalyst Sd-Wan, Cisco Catalyst SD-WAN Controller, Cisco Catalyst SD-WAN Manager or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20182: Cisco Catalyst SD-WAN authentication bypass in peering mechanism

CVE-2026-20182 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-05-14

A critical vulnerability has been identified in Cisco's SD-WAN management and control components, which are used to orchestrate and secure corporate wide-area networks. An unauthenticated attacker can bypass security checks to gain administrative access to the network controller. This could allow an attacker to modify network configurations, potentially leading to data interception, network outages, or full control over the organization's SD-WAN fabric.

Technologies: Cisco Catalyst SD-WAN Manager. Vendors: Cisco.

Quick answers

Is CVE-2026-20182 exploited in the wild?: Yes. CVE-2026-20182 is known to be exploited in the wild, first recorded on 14 May 2026. Treat it as urgent.
How severe is CVE-2026-20182?: Critical severity, with a CVSS score of 10, published 14 May 2026.
Which products and versions are affected?: Cisco Catalyst SD-WAN Controller (vSmart); Cisco Catalyst SD-WAN Manager (vManage); Cisco Catalyst SD-WAN Validator (vBond).
Is there a fix for CVE-2026-20182?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20182 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20182?: Check whether you run Cisco Catalyst Sd-Wan, Cisco Catalyst SD-WAN Controller, Cisco Catalyst SD-WAN Manager or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller, Manager, and Validator (formerly vSmart, vManage, and vBond) allows for an authentication bypass. The flaw is rooted in improper handling of control connection handshaking, where the peering authentication mechanism fails to correctly validate identity. An unauthenticated, remote attacker can exploit this by sending crafted requests to an affected system. Successful exploitation allows the attacker to log in as a high-privileged, non-root user and access NETCONF, enabling full manipulation of the SD-WAN fabric configuration. Cisco has released software updates to address this issue; no workarounds are available.

Affected products

Cisco Catalyst SD-WAN Controller (vSmart)
Cisco Catalyst SD-WAN Manager (vManage)
Cisco Catalyst SD-WAN Validator (vBond)

Timeline

2026-05-14: advisory: Initial publication of CVE-2026-20182
2026-05-14: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2026-06-16: other: Advisory updated to version 2.0 (Final)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.