# Cisco Catalyst SD-WAN CVE-2026-20182 — Critical Authentication Bypass Zero-Day Actively Exploited by UAT-8616 (CVSS 10.0, CISA KEV, ED 26-03)

> Cisco disclosed CVE-2026-20182, a maximum-severity (CVSS 10.0) authentication bypass in Cisco Catalyst SD-WAN Controller (formerly vSmart) and SD-WAN Manager (formerly vManage) being actively exploited as a zero-day by sophisticated actor UAT-8616. An unauthenticated remote attacker sends crafted HTTPS requests to log in as an internal high-privileged non-root user, then pivots to NETCONF (TCP/830) to modify SD-WAN fabric configuration, inject SSH keys, escalate to root, and insert rogue peer routers enabling MITM interception of branch traffic. CISA added CVE-2026-20182 to the Known Exploited Vulnerabilities catalog and issued Emergency Directive ED 26-03 on 2026-05-14, mandating Federal Civilian Executive Branch patching within 7 days. No workarounds exist — only patched firmware mitigates.

- **Published:** 2026-05-14T12:00:00Z
- **Last reviewed:** 2026-05-14T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0516
- **ID:** TL-2026-0516
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UAT-8616
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20182, CVE-2026-20122

## Description

## Overview

On 2026-05-14, Cisco Talos disclosed ongoing in-the-wild exploitation of CVE-2026-20182, a previously unknown (zero-day) critical authentication bypass vulnerability in the management plane of Cisco Catalyst SD-WAN Controller (legacy name vSmart) and Catalyst SD-WAN Manager (legacy name vManage). The flaw carries the maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and was discovered by Rapid7 researchers while investigating exploitation of a related vulnerability, CVE-2026-20127.

Cisco Talos attributes the campaign with HIGH confidence to UAT-8616, a sophisticated threat actor previously associated with the exploitation of CVE-2026-20127 (tracked as TL-2026-0145/0166/0236) and the CVE-2026-20122/20128/20133 chain (TL-2026-0185). UAT-8616 operates an Operational Relay Box (ORB) network — a mesh of compromised SOHO routers, VPS instances, and small enterprise edges — used to obscure command infrastructure and conduct staged reconnaissance against telecommunications, government, and managed service provider targets.

## Vulnerability Mechanics

CVE-2026-20182 is a logic flaw in the web management plane's pre-authentication request router. When a specially crafted HTTPS POST is delivered to a specific REST endpoint on the management interface, the controller's authentication middleware fails to invoke the role-resolution callback for a class of requests routed through an internal sub-process bridge. The middleware instead falls through to a default principal binding that maps to a built-in non-root operator account with the role group `netadmin` — a high-privileged service identity intended only for inter-process calls. This grants the attacker an authenticated session (`X-Auth-Token` cookie) without supplying credentials.

Once authenticated as the internal `netadmin`-equivalent principal, the attacker has full read/write access to NETCONF (TCP/830) and the controller's REST API. From there, the attacker can:

1. **SSH Key Injection**: Push a new authorized public key to the controller's `admin` (or other configured) user via NETCONF `<edit-config>` against the `/system/aaa/user[name='admin']/public-key` subtree, enabling persistent passwordless SSH (TCP/22 or non-standard CLI ports) without triggering credential-based AAA logging.
2. **NETCONF Configuration Manipulation**: Modify SD-WAN templates, route policies, vEdge device profiles, and feature templates to alter forwarding behavior across the entire SD-WAN fabric.
3. **Privilege Escalation to Root**: Chain a separate local privilege escalation primitive (observed in the wild as abuse of the `vshell` debugging shell or template pre-script execution on legacy 20.x vManage builds) to obtain root on the underlying Linux substrate.
4. **Rogue Peer Insertion**: Add an attacker-controlled vEdge or cEdge router with a fraudulent certificate to the fabric's Overlay Management Protocol (OMP) peering, then push site-list / control-policy updates that redirect a victim site's data-plane traffic through the rogue peer for collection or MITM injection.

## Exploit Chain Analysis

Observed attack sequence:

- **Initial Access (T1190)**: Crafted HTTPS POST to vulnerable controller REST endpoint -> authenticated session token issued (auth bypass).
- **Execution / Discovery (T1083, T1518)**: NETCONF `<get-config>` enumeration of running config, device inventory (`/devices`), feature templates, and active sessions.
- **Persistence (T1098.004, T1505)**: `<edit-config>` push of attacker SSH public key to admin user authorized_keys via NETCONF.
- **Privilege Escalation (T1068)**: Local-PE chain (template script execution / `vshell` abuse) -> root on Linux substrate.
- **Defense Evasion (T1070.002, T1562.001)**: Clear of `/var/log/vmanage/server.log`, `audit.log`, `confd.log`; suppression of audit subsystem; deletion of staged scripts.
- **Lateral Movement (T1210, T1021.004)**: SSH from controller to managed vEdges/cEdges using fabric-trust certificates; deployment of rogue OMP peer.
- **Collection / Impact (T1557, T1565.002)**: OMP route manipulation to siphon site traffic through attacker peer; potential data manipulation in transit.

## C2 Infrastructure / ORB Overlap

Cisco Talos reports the campaign uses a tiered ORB network, with first-hop relays consisting of compromised MikroTik RouterOS devices and ASUS / TP-Link SOHO routers (consistent with prior UAT-8616 patterns and infrastructure overlap with the Cuttlefish / FaceFish ORB clusters). Second-tier infrastructure runs on bullet-proof VPS providers (Chang Way Technologies AS57523, Hosting Solution Ltd AS207713) and rotates rapidly. Talos shared a partial IOC set with Cisco PSIRT and CISA; key IPs and a staging domain are published.

## Affected Products and Versions

- Cisco Catalyst SD-WAN Manager (vManage): 20.6.x prior to 20.6.7.4, 20.9.x prior to 20.9.5.3, 20.12.x prior to 20.12.3.2, 20.15.x prior to 20.15.1.1.
- Cisco Catalyst SD-WAN Controller (vSmart): same release trains; same fixed builds.
- Cisco Catalyst SD-WAN Validator (vBond): not affected per Cisco PSIRT (does not expose the vulnerable REST handler).
- Cisco IOS XE SD-WAN running on routing platforms: not affected.

## Mitigation

There are no workarounds. Cisco PSIRT and CISA ED 26-03 mandate immediate upgrade to fixed firmware. Operators should additionally rotate all controller credentials, audit `authorized_keys` on admin and operator accounts, review NETCONF audit logs for unexpected `<edit-config>` on `/system/aaa/user` and `/vpn/router` subtrees, validate OMP peer inventory against authorized device lists, and revoke / re-issue fabric certificates for any controller that cannot prove integrity. Federal Civilian Executive Branch agencies must complete remediation within 7 days under ED 26-03.

## Distinguishing From Prior UAT-8616 SD-WAN Cases

CVE-2026-20182 is distinct from previously tracked UAT-8616 SD-WAN exploitation:
- CVE-2026-20127 (TL-2026-0145/0166/0236): authenticated NETCONF-based privilege manipulation; requires valid credentials.
- CVE-2026-20122/20128/20133 chain (TL-2026-0185): SD-WAN Manager command injection chain requiring valid low-privilege user.
CVE-2026-20182 is the first fully unauthenticated, single-request entry point in the UAT-8616 SD-WAN toolkit, materially lowering the bar to initial access and explaining the surge in opportunistic scanning observed in early May 2026.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1556 Modify Authentication Process
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1601 Modify System Image
- T1599 Network Boundary Bridging
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1046 Network Service Discovery
- T1518 Software Discovery
- T1210 Exploitation of Remote Services
- T1021 Remote Services
- T1557 Adversary-in-the-Middle
- T1090 Proxy
- T1071 Application Layer Protocol
- T1565 Data Manipulation
- T1498 Network Denial of Service

## Sources

- [Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities (Cisco Talos)](https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/)
- [Cisco warns of new critical SD-WAN flaw exploited in zero-day attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-critical-sd-wan-flaw-exploited-in-zero-day-attacks/)
- [CISA Adds One Known Exploited Vulnerability to Catalog — CVE-2026-20182](https://www.cisa.gov/news-events/alerts/2026/05/14/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CISA Emergency Directive ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems](https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems)
- [Cisco Security Advisory cisco-sa-sdwan-authbypass-CVE-2026-20182](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbypass-2026-20182)
- [Rapid7 Research: Discovering CVE-2026-20182 while investigating CVE-2026-20127](https://www.rapid7.com/blog/post/cve-2026-20182-cisco-sd-wan-auth-bypass/)
- [NVD entry for CVE-2026-20182](https://nvd.nist.gov/vuln/detail/CVE-2026-20182)
- [Threadlinqs prior coverage: UAT-8616 CVE-2026-20127 exploitation (TL-2026-0145)](https://intel.threadlinqs.com/threat/TL-2026-0145)
- [Threadlinqs prior coverage: UAT-8616 SD-WAN command-injection chain CVE-2026-20122/20128/20133 (TL-2026-0185)](https://intel.threadlinqs.com/threat/TL-2026-0185)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0516