Cisco Catalyst SD-WAN CVE-2026-20182 — Critical Authentication Bypass Zero-Day Actively Exploited by UAT-8616 (CVSS 10.0, CISA KEV, ED 26-03)

Cisco Catalyst SD-WAN CVE-2026-20182 (TL-2026-0516), also tracked as UAT-8616 SD-WAN ZeroDay May 2026, is a critical-severity software vulnerability scored CVSS 10, first published 2026-05-14. It is attributed to UAT-8616 with high confidence, affects Cisco Catalyst SD-WAN Manager (vManage), references 1 CVE (CVE-2026-20182), maps to 29 MITRE ATT&CK techniques (T1021, T1046, T1059), and is covered by 9 detection rules and 26 indicators of compromise.

Key facts for TL-2026-0516

Threat ID
TL-2026-0516
Also known as
UAT-8616 SD-WAN ZeroDay May 2026, Cisco SD-WAN AuthBypass 2026-20182
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-05-14
Last reviewed
2026-05-14
Attribution
UAT-8616
Attribution confidence
HIGH
Motivation
ESPIONAGE
Target sectors
telecommunications, government, managed-service-providers, financial-services, defense-industrial-base, energy, critical-infrastructure
Target regions
North America, Europe, Asia-Pacific, Latin America
Detection rules
9
Indicators of compromise
26

Malware and tooling in Cisco Catalyst SD-WAN CVE-2026-20182

Malware and tooling: Custom UAT-8616 NETCONF toolkit (internally referenced by Talos as 'NetconfDrift'), UAT-8616 ORB mesh (MikroTik RouterOS + ASUS/TP-Link SOHO compromised devices, infrastructure overlap with Cuttlefish/FaceFish clusters)

Cisco disclosed CVE-2026-20182, a maximum-severity (CVSS 10.0) authentication bypass in Cisco Catalyst SD-WAN Controller (formerly vSmart) and SD-WAN Manager (formerly vManage) being actively exploited as a zero-day by sophisticated actor UAT-8616. An unauthenticated remote attacker sends crafted HTTPS requests to log in as an internal high-privileged non-root user, then pivots to NETCONF (TCP/830) to modify SD-WAN fabric configuration, inject SSH keys, escalate to root, and insert rogue peer routers enabling MITM interception of branch traffic. CISA added CVE-2026-20182 to the Known Exploited Vulnerabilities catalog and issued Emergency Directive ED 26-03 on 2026-05-14, mandating Federal Civilian Executive Branch patching within 7 days. No workarounds exist — only patched firmware mitigates.

How Cisco Catalyst SD-WAN CVE-2026-20182 works

## Overview

On 2026-05-14, Cisco Talos disclosed ongoing in-the-wild exploitation of CVE-2026-20182, a previously unknown (zero-day) critical authentication bypass vulnerability in the management plane of Cisco Catalyst SD-WAN Controller (legacy name vSmart) and Catalyst SD-WAN Manager (legacy name vManage). The flaw carries the maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and was discovered by Rapid7 researchers while investigating exploitation of a related vulnerability, CVE-2026-20127.

Cisco Talos attributes the campaign with HIGH confidence to UAT-8616, a sophisticated threat actor previously associated with the exploitation of CVE-2026-20127 (tracked as TL-2026-0145/0166/0236) and the CVE-2026-20122/20128/20133 chain (TL-2026-0185). UAT-8616 operates an Operational Relay Box (ORB) network — a mesh of compromised SOHO routers, VPS instances, and small enterprise edges — used to obscure command infrastructure and conduct staged reconnaissance against telecommunications, government, and managed service provider targets.

## Vulnerability Mechanics

CVE-2026-20182 is a logic flaw in the web management plane's pre-authentication request router. When a specially crafted HTTPS POST is delivered to a specific REST endpoint on the management interface, the controller's authentication middleware fails to invoke the role-resolution callback for a class of requests routed through an internal sub-process bridge. The middleware instead falls through to a default principal binding that maps to a built-in non-root operator account with the role group `netadmin` — a high-privileged service identity intended only for inter-process calls. This grants the attacker an authenticated session (`X-Auth-Token` cookie) without supplying credentials.

Once authenticated as the internal `netadmin`-equivalent principal, the attacker has full read/write access to NETCONF (TCP/830) and the controller's REST API. From there, the attacker can:

1. **SSH Key Injection**: Push a new authorized public key to the controller's `admin` (or other configured) user via NETCONF `<edit-config>` against the `/system/aaa/user[name='admin']/public-key` subtree, enabling persistent passwordless SSH (TCP/22 or non-standard CLI ports) without triggering credential-based AAA logging. 2. **NETCONF Configuration Manipulation**: Modify SD-WAN templates, route policies, vEdge device profiles, and feature templates to alter forwarding behavior across the entire SD-WAN fabric. 3. **Privilege Escalation to Root**: Chain a separate local privilege escalation primitive (observed in the wild as abuse of the `vshell` debugging shell or template pre-script execution on legacy 20.x vManage builds) to obtain root on the underlying Linux substrate. 4. **Rogue Peer Insertion**: Add an attacker-controlled vEdge or cEdge router with a fraudulent certificate to the fabric's Overlay Management Protocol (OMP) peering, then push site-list / control-policy updates that redirect a victim site's data-plane traffic through the rogue peer for collection or MITM injection.

## Exploit Chain Analysis

Observed attack sequence:

- **Initial Access (T1190)**: Crafted HTTPS POST to vulnerable controller REST endpoint -> authenticated session token issued (auth bypass). - **Execution / Discovery (T1083, T1518)**: NETCONF `<get-config>` enumeration of running config, device inventory (`/devices`), feature templates, and active sessions. - **Persistence (T1098.004, T1505)**: `<edit-config>` push of attacker SSH public key to admin user authorized_keys via NETCONF. - **Privilege Escalation (T1068)**: Local-PE chain (template script execution / `vshell` abuse) -> root on Linux substrate. - **Defense Evasion (T1070.002, T1562.001)**: Clear of `/var/log/vmanage/server.log`, `audit.log`, `confd.log`; suppression of audit subsystem; deletion of staged scripts. - **Lateral Movement (T1210, T1021.004)**: SSH from controller to managed vEdges/cEdges using fabric-trust certificates; deployment of rogue OMP peer. - **Collection / Impact (T1557, T1565.002)**: OMP route manipulation to siphon site traffic through attacker peer; potential data manipulation in transit.

## C2 Infrastructure / ORB Overlap

Cisco Talos reports the campaign uses a tiered ORB network, with first-hop relays consisting of compromised MikroTik RouterOS devices and ASUS / TP-Link SOHO routers (consistent with prior UAT-8616 patterns and infrastructure overlap with the Cuttlefish / FaceFish ORB clusters). Second-tier infrastructure runs on bullet-proof VPS providers (Chang Way Technologies AS57523, Hosting Solution Ltd AS207713) and rotates rapidly. Talos shared a partial IOC set with Cisco PSIRT and CISA; key IPs and a staging domain are published.

## Affected Products and Versions

- Cisco Catalyst SD-WAN Manager (vManage): 20.6.x prior to 20.6.7.4, 20.9.x prior to 20.9.5.3, 20.12.x prior to 20.12.3.2, 20.15.x prior to 20.15.1.1. - Cisco Catalyst SD-WAN Controller (vSmart): same release trains; same fixed builds. - Cisco Catalyst SD-WAN Validator (vBond): not affected per Cisco PSIRT (does not expose the vulnerable REST handler). - Cisco IOS XE SD-WAN running on routing platforms: not affected.

## Mitigation

There are no workarounds. Cisco PSIRT and CISA ED 26-03 mandate immediate upgrade to fixed firmware. Operators should additionally rotate all controller credentials, audit `authorized_keys` on admin and operator accounts, review NETCONF audit logs for unexpected `<edit-config>` on `/system/aaa/user` and `/vpn/router` subtrees, validate OMP peer inventory against authorized device lists, and revoke / re-issue fabric certificates for any controller that cannot prove integrity. Federal Civilian Executive Branch agencies must complete remediation within 7 days under ED 26-03.

## Distinguishing From Prior UAT-8616 SD-WAN Cases

CVE-2026-20182 is distinct from previously tracked UAT-8616 SD-WAN exploitation: - CVE-2026-20127 (TL-2026-0145/0166/0236): authenticated NETCONF-based privilege manipulation; requires valid credentials. - CVE-2026-20122/20128/20133 chain (TL-2026-0185): SD-WAN Manager command injection chain requiring valid low-privilege user. CVE-2026-20182 is the first fully unauthenticated, single-request entry point in the UAT-8616 SD-WAN toolkit, materially lowering the bar to initial access and explaining the surge in opportunistic scanning observed in early May 2026.

MITRE ATT&CK techniques used in TL-2026-0516

Lateral Movement

T1021 Remote Services; T1210 Exploitation of Remote Services

Discovery

T1046 Network Service Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts

Defense Evasion

T1070 Indicator Removal

Command and Control

T1071 Application Layer Protocol; T1090 Proxy

Persistence

T1098 Account Manipulation; T1505 Server Software Component; T1556 Modify Authentication Process

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Impact

T1498 Network Denial of Service; T1565 Data Manipulation

Credential Access

T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Collection

T1557 Adversary-in-the-Middle

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1587 Develop Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

defense-impairment

T1599 Network Boundary Bridging; T1601 Modify System Image; T1685 Disable or Modify Tools

Affected products and versions in Cisco Catalyst SD-WAN CVE-2026-20182

  • Cisco — Catalyst SD-WAN Manager (vManage)
    Vulnerable versions: 20.6.x prior to 20.6.7.4; 20.9.x prior to 20.9.5.3; 20.12.x prior to 20.12.3.2; 20.15.x prior to 20.15.1.1
    Fixed in: 20.6.7.4; 20.9.5.3; 20.12.3.2; 20.15.1.1
  • Cisco — Catalyst SD-WAN Controller (vSmart)
    Vulnerable versions: 20.6.x prior to 20.6.7.4; 20.9.x prior to 20.9.5.3; 20.12.x prior to 20.12.3.2; 20.15.x prior to 20.15.1.1
    Fixed in: 20.6.7.4; 20.9.5.3; 20.12.3.2; 20.15.1.1
  • Cisco — Catalyst SD-WAN Validator (vBond)
    Fixed in: Not affected — does not expose vulnerable REST handler
  • Cisco — IOS XE SD-WAN (routing platforms)
    Fixed in: Not affected

Remediation for Cisco Catalyst SD-WAN CVE-2026-20182

Patches

  • Upgrade Catalyst SD-WAN Manager / Controller 20.6.x to 20.6.7.4 or later
  • Upgrade Catalyst SD-WAN Manager / Controller 20.9.x to 20.9.5.3 or later
  • Upgrade Catalyst SD-WAN Manager / Controller 20.12.x to 20.12.3.2 or later
  • Upgrade Catalyst SD-WAN Manager / Controller 20.15.x to 20.15.1.1 or later

Immediate actions

  • Restrict management-plane (HTTPS/443, NETCONF/830, SSH/22) exposure of Catalyst SD-WAN Manager and Controller to a dedicated management VLAN; block from the public internet immediately
  • Block known UAT-8616 IOC IPs and the staging domain at perimeter firewalls and on management-plane ACLs
  • Audit /system/aaa/user/*/public-key on all SD-WAN Manager and Controller nodes for unauthorized SSH public keys; remove and rotate any anomalies
  • Review NETCONF /var/log/confd/audit.log and vManage /var/log/nms/vmanage-server.log for unexpected <edit-config> operations on /system/aaa, /vpn, /omp, and /policy subtrees in the last 60 days
  • Validate the OMP peer inventory against the documented authorized vEdge/cEdge device list; revoke certificates for any unknown peer
  • Force-rotate all controller, admin, and netadmin credentials; revoke any persistent API/CLI tokens

Workarounds

  • No vendor-supplied workarounds. Cisco PSIRT explicitly states patching is the only mitigation. Compensating control: remove all internet exposure of management interfaces and enforce source-IP allow-listing on the management VLAN until patches are applied.

Longer-term hardening

  • Enforce management-plane segmentation: never expose SD-WAN Manager/Controller HTTPS or NETCONF to untrusted networks
  • Deploy a dedicated jump-host with MFA in front of all SD-WAN management interfaces and require source-IP allow-listing
  • Stream NETCONF audit, AAA, and HTTPS access logs to a SIEM with detections for anomalous unauthenticated REST POSTs immediately followed by privileged NETCONF activity
  • Establish an OMP peer-change alerting baseline; any new peer or unexpected control-policy change pages on-call within 5 minutes
  • Adopt a fabric-certificate rotation schedule and document an emergency revocation procedure
  • Subscribe to Cisco PSIRT and CISA KEV email feeds with on-call paging for SD-WAN advisories

CVEs associated with Cisco Catalyst SD-WAN CVE-2026-20182

CVE-2026-20182

Weaknesses (CWE) in Cisco Catalyst SD-WAN CVE-2026-20182

CWE-287, CWE-288, CWE-306, CWE-863

Timeline of Cisco Catalyst SD-WAN CVE-2026-20182

  • Rapid7 researchers, while investigating in-the-wild exploitation of CVE-2026-20127, identify a separate pre-authentication code path in Cisco Catalyst SD-WAN Manager that fails to invoke role resolution and returns a valid session token to unauthenticated callers.
  • Rapid7 reports the new vulnerability to Cisco PSIRT under coordinated disclosure; Cisco confirms the issue and reserves CVE-2026-20182.
  • Cisco Talos observes the first in-the-wild exploitation attempts of CVE-2026-20182 against telecommunications customers, prior to public disclosure (zero-day window opens).
  • Talos achieves HIGH-confidence attribution of the exploitation campaign to UAT-8616 based on TLS JA4 fingerprint reuse, ORB infrastructure overlap with prior CVE-2026-20127 and CVE-2026-20122/20128/20133 cases, and identical post-exploitation NETCONF tradecraft.
  • Cisco Talos and Cisco PSIRT finalize coordinated disclosure timeline with Rapid7 and notify CISA of active exploitation and impending public release.
  • GreyNoise and Shadowserver report a >20x surge in opportunistic scanning of TCP/443 against Cisco SD-WAN management fingerprints within 12 hours of disclosure; multiple non-UAT-8616 actors join the exploitation.
  • CISA issues Emergency Directive ED 26-03 mandating Federal Civilian Executive Branch (FCEB) agencies patch or isolate vulnerable Cisco Catalyst SD-WAN systems within 7 days (deadline 2026-05-21).
  • CISA adds CVE-2026-20182 to the Known Exploited Vulnerabilities (KEV) catalog the same day as public disclosure.
  • Cisco publishes security advisory cisco-sa-sdwan-authbypass-2026-20182; Cisco Talos publishes campaign blog; Rapid7 publishes technical writeup; BleepingComputer reports on the active zero-day exploitation.
  • CISA ED 26-03 remediation deadline: all FCEB agencies must report compliance via CDM dashboards or detail isolation/decommissioning plans for unpatched devices.
  • As of 2026-05-29, CVE-2026-20182 (CVSS 10.0 Cisco SD-WAN auth bypass) remains an active, CISA KEV-listed zero-day under ED 26-03, patched 2026-05-14 but still exploited in the wild by undisrupted actor UAT-8616 plus 10+ additional clusters. Patches exist yet edge-device patching lags and no takedown/arrest has occurred, so the threat stays live.

Sources cited for Cisco Catalyst SD-WAN CVE-2026-20182

Threats related to Cisco Catalyst SD-WAN CVE-2026-20182

Detection coverage for TL-2026-0516

As of 2026-05-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0516 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats