Intel

CVE-2026-20182

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in Febru…

criticalKEV: actively exploitedPoCEPSS 92%

Description

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.  A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

Source: EUVDCISCO_CSAFCISA_KEVNVDCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

With a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and an EPSS percentile of 99.8 %, this vulnerability represents one of the highest-probability exploitation risks currently tracked. The flaw requires no credentials, no user interaction, and is exploitable over the network — granting an attacker NETCONF-level control over the entire SD-WAN fabric, enabling arbitrary network configuration manipulation across all connected sites. For NIS2-regulated operators and KRITIS organisations relying on Cisco Catalyst SD-WAN for WAN connectivity, a successful exploit could compromise the integrity and availability of critical network segments at scale. Although CISA has not confirmed ransomware campaign use, the primitive (unauthenticated full-fabric control) is highly attractive for sabotage and espionage scenarios; patching and management-plane isolation must be treated as P1 actions ahead of all other remediation work.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch immediately: Cisco has released fixes for this authentication bypass. Consult the Cisco Security Advisory for CVE-2026-20182 (cisco.com/security/advisories) to identify the exact fixed release for your train. All affected versions (20.9.9.1, 20.10–20.12.6.2, 20.13–20.15.5.2, 20.16–20.18.2.2, 26.1–26.1.1.1) must be patched without delay.
  • Isolate the SD-WAN management plane: Catalyst SD-WAN Manager, Controller (vSmart), and Validator (vBond) must be reachable only from a dedicated management VLAN or out-of-band network. Block all inbound connections from the internet or untrusted segments at the perimeter firewall immediately.
  • Block NETCONF (TCP 830) from unauthorised sources: Because successful exploitation grants NETCONF access, restrict TCP 830 at both the perimeter firewall and on the devices themselves to explicitly whitelisted management source IPs.
  • Audit active control-plane peering connections: Run show control connections on all affected controllers (as directed in the Cisco advisory) and identify any unknown or unexpected peering peers. Terminate suspicious sessions immediately.
  • Rotate privileged credentials: Rotate all SD-WAN Manager administrator passwords, API keys, and NETCONF credentials after isolating the systems. Assume that a compromised internal account may have been used to stage further access.
  • Activate incident response if indicators are present: If show control connections reveals unknown peers, or if unexpected fabric configuration changes are detected, invoke your IR process and preserve configuration snapshots as forensic artefacts.

Runbook · Step 2

Mitigation layers

  • Network segmentation (primary compensating control): Operate all SD-WAN control-plane components exclusively on RFC-1918 addresses within an isolated management segment. Apply ACLs on upstream routers and firewalls permitting only explicitly authorised management hosts.
  • Firewall ACL for SD-WAN control ports: Restrict SD-WAN peering ports (DTLS/TLS on UDP/TCP 12346, 12366, 12386) and NETCONF (TCP 830) to source-IP whitelists. Use DROP rather than REJECT to reduce fingerprinting exposure.
  • IPS signature for anomalous DTLS handshakes: On Cisco IOS XE IPS or Snort-based sensors, enable anomaly detection for malformed or unexpected DTLS handshake sequences on SD-WAN control ports. Target content:"HELLO" in DTLS records originating from non-whitelisted source IPs.
  • Least-privilege NETCONF access: Restrict NETCONF access on the Manager to named service accounts only; remove all other accounts from the NETCONF ACL. Enforce change-management logging for all NETCONF-driven configuration changes.
  • Temporarily disable unused peering: If specific Controller instances have no active peering requirements, disable the peering feature until the patch is applied, reducing the exploitable attack surface.

Runbook · Step 3

Detection rules

  • Network telemetry (Zeek/Suricata): Alert on connection attempts to TCP/UDP 12346, 12366, 12386, or TCP 830 from source IPs outside the defined management address space. KQL: NetworkEvents | where DestinationPort in (830, 12346, 12366, 12386) and SourceIP !in (management_ip_list).
  • Cisco SD-WAN Manager audit log / syslog: Detect login events for internal high-privileged system accounts that are not preceded by a normal authentication challenge sequence. Sigma shape: logsource: product: cisco_sdwan | detection: keywords: ["login successful", "internal"] | filter: NOT preceded_by: auth_challenge.
  • NETCONF session monitoring: Alert on new NETCONF <hello> messages from unauthorised source IPs or outside approved maintenance windows. Cross-reference Manager host auth logs: grep "netconf" /var/log/auth.log with source IP validation.
  • Fabric configuration change alerting: Any SD-WAN fabric configuration change (templates, policies, VPN segments) outside an approved change window should trigger an immediate high-severity alert. SPL: index=sdwan sourcetype=cisco_sdwan_audit action=config_change | where NOT change_window=true.
  • show control connections baseline drift: Implement automated polling of control-connection state and compare against a known-good baseline. Any new peer IP or certificate not in the baseline should generate a high-severity alert.

Metrics

Severity
critical
Priority score
235.69
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
10.0
Source: nvd-v3
CVSS v3
10.0
CVSS v4
—
EPSS percentile
99.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
91.5 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2026-05-14 16:08 UTC
CWE
CWE-287

Weakness classes (CWE)

  • CWE-287Class

    Improper Authentication

    When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-06-16 19:16 UTC· psirt@cisco.com
    • Description: May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.&nbsp; A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. → May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.&nbsp; A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • cisco

    catalyst_sd-wan_manager20.10 – 20.12.5.4

  • cisco

    catalyst_sd-wan_manager20.12.6 – 20.12.6.2

  • cisco

    catalyst_sd-wan_manager20.13 – 20.15.4.4

  • cisco

    catalyst_sd-wan_manager20.15.5 – 20.15.5.2

  • cisco

    catalyst_sd-wan_manager20.16 – 20.18.2.2

  • cisco

    catalyst_sd-wan_manager26.1 – 26.1.1.1

  • cisco

    catalyst_sd-wan_manager20.9.9.1

  • cisco

    catalyst_sd-wan_manager

  • cisco

    sd-wan_vbond_orchestrator20.10 – 20.12.5.4

  • cisco

    sd-wan_vbond_orchestrator20.12.6 – 20.12.6.2

  • cisco

    sd-wan_vbond_orchestrator20.13 – 20.15.4.4

  • cisco

    sd-wan_vbond_orchestrator20.15.5 – 20.15.5.2

  • cisco

    sd-wan_vbond_orchestrator20.16 – 20.18.2.2

  • cisco

    sd-wan_vbond_orchestrator26.1 – 26.1.1.1

  • cisco

    sd-wan_vbond_orchestrator20.9.9.1

  • cisco

    sd-wan_vbond_orchestrator

  • cisco

    sd-wan_vsmart_controller20.10 – 20.12.5.4

  • cisco

    sd-wan_vsmart_controller20.12.6 – 20.12.6.2

  • cisco

    sd-wan_vsmart_controller20.13 – 20.15.4.4

  • cisco

    sd-wan_vsmart_controller20.15.5 – 20.15.5.2

  • cisco

    sd-wan_vsmart_controller20.16 – 20.18.2.2

  • cisco

    sd-wan_vsmart_controller26.1 – 26.1.1.1

  • cisco

    sd-wan_vsmart_controller20.9.9.1

  • cisco

    sd-wan_vsmart_controller

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked advisories

IDCVE-2026-20182
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in Febru… — CVE-2026-20182 | NEOSEC Intel