Cisco Catalyst SD-WAN CVE-2026-20182 — Critical Authentication Bypass Zero-Day Actively Exploited by UAT-8616 (CVSS 10.0, CISA KEV, ED 26-03) — Threadlinqs Intelligence
As of 2026-05-30, Cisco Catalyst SD-WAN CVE-2026-20182 — Critical Authentication Bypass Zero-Day Actively Exploited by UAT-8616 (CVSS 10.0, CISA KEV, ED 26-03) is a critical-severity vulnerability threat attributed to UAT-8616, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-0516 · Severity: CRITICAL · CVSS: 10 · Status: ACTIVE · Category: VULNERABILITY
Attribution: UAT-8616 · ESPIONAGE
Cisco disclosed CVE-2026-20182, a maximum-severity (CVSS 10.0) authentication bypass in Cisco Catalyst SD-WAN Controller (formerly vSmart) and SD-WAN Manager (formerly vManage) being actively
## Overview
On 2026-05-14, Cisco Talos disclosed ongoing in-the-wild exploitation of CVE-2026-20182, a previously unknown (zero-day) critical authentication bypass vulnerability in the management plane of Cisco Catalyst SD-WAN Controller (legacy name vSmart) and Catalyst SD-WAN Manager (legacy name vManage). The flaw carries the maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and was discovered by Rapid7 researchers while investigating exploitation of a related vulnerability, CVE-2026-20127.
Cisco Talos attributes the campaign with HIGH confidence to UAT-8616, a sophisticated threat actor previously associated with the exploitation of CVE-2026-20127 (tracked as TL-2026-0145/0166/0236) and the CVE-2026-20122/20128/20133 chain (TL-2026-0185). UAT-8616 operates an Operational Relay Box (ORB) network — a mesh of compromised SOHO routers, VPS instances, and small enterprise edges — used to obscure command infrastructure and conduct staged reconnaissance against telecommunications, government, and managed service provider targets.
## Vulnerability Mechanics
CVE-2026-20182 is a logic flaw in the web management plane's pre-authentication request router. When a specially crafted HTTPS POST is delivered to a specific REST endpoint on the management interface, the controller's authentication middleware fails to invoke the role-resolution callback for a class of requests routed through an internal sub-process bridge. The middleware instead falls through to a default principal binding that maps to a built-in non-root operator account with the role group `netadmin` — a high-privileged service identity intended only for inter-process calls. This grants the attacker an authenticated session (`X-Auth-Token` cookie) without supplying credentials.
Once authenticated as the internal `netadmin`-equivalent principal, the attacker has full read/write access to NETCONF (TCP/830) and the controller's REST API. From there, the attacker can:
1. **SSH Key Injection**: Push a new authorized public key to the controller's `admin` (or other configured) user via NETCONF `<edit-config>` against the `/system/aaa/user[name='admin']/public-key` subtree, enabling persistent passwordless SSH (TCP/22 or non-standard CLI ports) without triggering credential-based AAA logging.
2. **NETCONF Configuration Manipulation**: Modify SD-WAN templates, route policies, vEdge device profiles, and feature templates to alter forwarding behavior across the entire SD-WAN fabric.
3. **Privilege Escalation to Root**: Chain a separate local privilege escalation primitive (observed in the wild as abuse of the `vshell` debugging shell or template pre-script execution on legacy 20.x vManage builds) to obtain root on the underlying Linux substrate.
4. **Rogue Peer Insertion**: Add an attacker-controlled vEdge or cEdge router with a fraudulent certificate to the fabric's Overlay Management Protocol (OMP) peering, then push site-list / control-policy updates that redirect a victim site's data-plane traffic through the rogue peer for collection or MITM injection.
## Exploit Chain Analysis
Observed attack sequence:
- **Initial Access (T1190)**: Crafted HTTPS POST to vulnerable controller REST endpoint -> authenticated session token issued (auth bypass).
- **Execution / Discovery (T1083, T1518)**: NETCONF `<get-config>` enumeration of running config, device inventory (`/devices`), feature templates, and active sessions.
- **Persistence (T1098.004, T1505)**: `<edit-config>` push of attacker SSH public key to admin user authorized_keys via NETCONF.
- **Privilege Escalation (T1068)**: Local-PE chain (template script execution / `vshell` abuse) -> root on Linux substrate.
- **Defense Evasion (T1070.002, T1562.001)**: Clear of `/var/log/vmanage/server.log`, `audit.log`, `confd.log`; suppression of audit subsystem; deletion of staged scripts.
- **Lateral Movement (T1210, T1021.004)**: SSH from controller to managed vEdges/cEdges using fabric-trust certificates; de
Weaknesses (CWE)
CWE-287, CWE-288, CWE-306, CWE-863
Target sectors: telecommunications, government, managed-service-providers, financial-services, defense-industrial-base, energy, critical-infrastructure
Target regions: North America, Europe, Asia-Pacific, Latin America
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-20182, T1595, T1590, T1583, T1584, T1587, T1190, T1133, T1059, T1059, T1098