cyber.hendryadrian.com
Vulnerability & Exploit · darkreading.com

Cisco SD-WAN Authentication Bypass CVE-2026-20182 Exploited in the Wild

· Original article ↗

Summary

Cisco Talos reports UAT-8616 is exploiting CVE-2026-20182, a CVSS 10 authentication bypass in Cisco Catalyst SD-WAN Controllers. Observed follow-on activity includes SSH-key additions, NETCONF changes and root escalation; Cisco has released a patch.

Key points

  • CVE-2026-20182 is a critical authentication bypass in Cisco Catalyst SD-WAN Controllers, rated CVSS 10.0.
  • Cisco Talos reports that the actor it tracks as UAT-8616 has exploited the vulnerability in the wild.
  • Talos observed post-compromise actions including adding SSH keys, modifying NETCONF configurations and escalating privileges to root.
  • The flaw involves the Controller failing to verify a specific vHub component before authenticating it, potentially allowing attackers to gain administrative access.
  • Cisco has released a patch; the article warns that compromise of a centralized controller could affect an organization's SD-WAN overlay network.

Article Details

Vulnerability Types
  • Authentication bypass
Severity
Critical (CVSS 10.0)
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationResearchers reported that UAT-8616 escalated access to root on targeted systems.T1098.004 · SSH Authorized KeysCisco Talos reported that UAT-8616 added SSH keys to systems after exploiting the vulnerability.

CVE

CVE-2022-20775Cisco · Cisco Catalyst SD-WAN; Cisco · Cisco Catalyst SD-WAN Manager; +3 moreThe first time UAT-8616 exploited a Catalyst authentication bypass bug, it took advantage of its access to exploit an older vulnerability, CVE-2022-20775, and escalate from privileged to outright root access.CVE-2026-20127Cisco · Cisco Catalyst SD-WAN ManagerThe cream was CVE-2026-20127, which gave unauthenticated attackers the power to log into Cisco controllers as high-privileged users.CVE-2026-20182Cisco · Cisco Catalyst SD-WAN Controller; Cisco · Cisco Catalyst SD-WAN ManagerA highly sophisticated threat actor, tracked as UAT-8616, is exploiting CVE-2026-20182, an authentication bypass flaw in Cisco Catalyst SD-WAN Controllers that can lead to administrative access and root compromise.

People

Douglas McKeeRapid7 director of vulnerability intelligence who discussed the operational risks of compromising an SD-WAN controller.Jonah BurgessRapid7 senior security researcher who warned that a compromised controller could affect an entire overlay network.

Threat Actors

UAT-8616Cisco Talos tracks UAT-8616 as the group exploiting Cisco Catalyst SD-WAN authentication bypass vulnerabilities; researchers reported post-compromise actions including adding SSH keys, modifying NETCONF configurations, and escalating to root.

Vendors

CiscoA highly sophisticated threat actor, tracked as UAT-8616, is exploiting CVE-2026-20182, an authentication bypass flaw in Cisco Catalyst SD-WAN Controllers that can lead to administrative access and root compromise.

Products

Cisco Catalyst SD-WAN ControllersA highly sophisticated threat actor, tracked as UAT-8616, is exploiting CVE-2026-20182, an authentication bypass flaw in Cisco Catalyst SD-WAN Controllers that can lead to administrative access and root compromise.

Industries

Critical infrastructureRapid7 and Cisco Talos warn that the bug has already been used in the wild, with attackers adding SSH keys, changing NETCONF settings, and targeting high-value organizations and critical infrastructure sectors.

Related Articles