Vulnerability & Exploit · cyberscoop.com

Cisco Warns of Ongoing Exploitation of SD-WAN Zero-Day CVE-2026-20182

May 15, 2026 · Original article ↗

Summary

Cisco says UAT-8616 is exploiting CVE-2026-20182, a critical authentication bypass in Catalyst SD-WAN Controller and Manager. Cisco released a patch; controller compromise could enable administrative access and affect the wider SD-WAN fabric.

Key points

CVE-2026-20182 is an authentication bypass in Cisco Catalyst SD-WAN Controller and Manager, rated CVSS 10.
Rapid7 reported the vulnerability to Cisco on March 9; Cisco said it had observed limited exploitation and described the activity as ongoing.
Cisco Talos attributed the latest attacks to UAT-8616.
Rapid7 said exploitation requires no credentials or prior knowledge of the target environment; Cisco said all deployment types are affected, including on-premises, cloud, and FedRAMP environments.
Cisco released a patch. Researchers warned that compromising a controller could provide administrative access and potentially enable traffic rerouting, communications interception, malicious configuration changes, or disruption across the SD-WAN fabric.
Cisco Talos said UAT-8616 and at least 10 other groups have chained three previously patched SD-WAN vulnerabilities: CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133.

Article Details

Vulnerability Types: Authentication bypass
Severity: Critical (CVSS 10)
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available

CVE

CVE-2026-20122Cisco · Catalyst sd-wan managerThe company previously disclosed and released patches for the vulnerabilities — including CVE-2026-20122, CVE-2026-20128 and CVE-2026-20133 — in February.CVE-2026-20127Cisco · Cisco Catalyst SD-WAN Managersaid it discovered the latest critical authentication bypass vulnerability when it was researching CVE-2026-20127, a previous zero-day the Five Eyes identified and confirmed as actively exploited by UAT-8616 in late CVE-2026-20128Cisco · Catalyst sd-wan managercompany previously disclosed and released patches for the vulnerabilities — including CVE-2026-20122, CVE-2026-20128 and CVE-2026-20133 — in February.CVE-2026-20133Cisco · Catalyst sd-wan managerdisclosed and released patches for the vulnerabilities — including CVE-2026-20122, CVE-2026-20128 and CVE-2026-20133 — in February.CVE-2026-20182Cisco · Cisco Catalyst SD-WAN Controller; Cisco · Cisco Catalyst SD-WAN ManagerAttackers exploited a critical authentication bypass in Cisco Catalyst SD-WAN Controller and Manager, tracked as CVE-2026-20182, which Cisco and Rapid7 say can grant the highest level of administrative access.

People

Douglas McKeeRapid7 director of vulnerability intelligence who discussed the authentication bypass and its potential impact.Jonah BurgessRapid7 senior security researcher who described the vulnerability's lack of credential requirements and the potential reach of a compromised controller.

Threat Actors

UAT-8616Cisco and Cisco Talos attributed exploitation of Cisco SD-WAN zero-days, including CVE-2026-20182, to this group; the article describes the latest exploitation as ongoing.

Vendors

CiscoAttackers exploited a critical authentication bypass in Cisco Catalyst SD-WAN Controller and Manager, tracked as CVE-2026-20182, which Cisco and Rapid7 say can grant the highest level of administrative access.

Products

Cisco Catalyst SD-WAN ControllerAttackers exploited a critical authentication bypass in Cisco Catalyst SD-WAN Controller and Manager, tracked as CVE-2026-20182, which Cisco and Rapid7 say can grant the highest level of administrative access.

Related Articles