cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

CISA Adds Cisco SD-WAN Authentication Bypass to KEV After Active Exploitation

· Original article ↗

Summary

CISA added CVE-2026-20182, a CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN, to KEV after active exploitation was confirmed. Cisco attributes activity with high confidence to UAT-8616; FCEB agencies must remediate by May 17, 2026.

Key points

  • CVE-2026-20182 allows unauthenticated remote attackers to bypass authentication and gain administrative privileges on affected Cisco Catalyst SD-WAN systems.
  • CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a May 17, 2026 remediation deadline for FCEB agencies.
  • Cisco attributed exploitation of CVE-2026-20182 with high confidence to UAT-8616, which attempted to add SSH keys, modify NETCONF configurations, and escalate privileges.
  • The reported activity used publicly available proof-of-concept code to deploy web shells, including the JSP-based XenShell, which can run bash commands.
  • Cisco reported at least 10 clusters exploiting CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122, with observed payloads including web shells, miners, backdoors, and credential stealers.
  • Cisco recommends customers follow its advisories for the vulnerabilities.

Article Details

Vulnerability Types
  • Authentication bypass
Severity
Critical (CVSS 10.0)
Exploitation Status
active
Exploit Availability
public_poc
Patch Status
unknown

MITRE ATT&CK

T1003 · OS Credential DumpingA deployed credential stealer attempted to obtain an administrator's hashdump.T1059.004 · Unix ShellThe deployed web shells allowed operators to run arbitrary bash commands.T1068 · Exploitation for Privilege EscalationUAT-8616 attempted to escalate privileges to root after exploiting the vulnerability.T1090 · ProxyOne cluster deployed gsocket, described as a peer-based proxying and tunneling tool.T1098.004 · SSH Authorized KeysUAT-8616 attempted to add SSH keys after compromising systems.T1190 · Exploit Public-Facing ApplicationAttackers exploited CVE-2026-20182 and other Cisco SD-WAN vulnerabilities to gain unauthorized access to affected devices.T1496 · Resource HijackingSome clusters deployed an XMRig miner on compromised systems.T1505.003 · Web ShellOperators deployed web shells, including XenShell, Godzilla, and Behinder, on compromised systems.

CVE

CVE-2026-20122Cisco · Catalyst sd-wan managercompany also observing multiple threat clusters exploiting CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 beginning March 2026.CVE-2026-20127Cisco · Cisco Catalyst SD-WAN Managerof CVE-2026-20182 with high confidence to UAT-8616, the same cluster behind the weaponization of CVE-2026-20127 to gain unauthorized access to SD-WAN systems.CVE-2026-20128Cisco · Catalyst sd-wan managerwith the cybersecurity company also observing multiple threat clusters exploiting CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 beginning March 2026.CVE-2026-20133Cisco · Catalyst sd-wan managerBox (ORB) networks, with the cybersecurity company also observing multiple threat clusters exploiting CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 beginning March 2026.CVE-2026-20182Cisco · Cisco Catalyst SD-WAN Controller; Cisco · Cisco Catalyst SD-WAN ManagerCISA has added CVE-2026-20182, a critical authentication bypass in Cisco Catalyst SD-WAN Controller and Manager, to its Known Exploited Vulnerabilities catalog after confirming active exploitation.

Threat Actors

UAT-8616Cisco attributed active exploitation of CVE-2026-20182 to UAT-8616 with high confidence. The cluster reportedly attempted to add SSH keys, modify NETCONF configurations, and escalate to root privileges after compromise.

Malware

BehinderCluster 2 (Active since at least March 10, 2026), which deploys the Behinder web shellGodzillaCluster 1 (Active since at least March 6, 2026), which deploys the Godzilla web shellXenShellOne such JavaServer Pages (JSP)-based web shell has been codenamed XenShell owing to the use of a PoC released by ZeroZenX Labs.XMRigCluster 7 (Active since at least March 25, 2026), which deploys an XMRig miner

Vendors

CiscoCISA has added CVE-2026-20182, a critical authentication bypass in Cisco Catalyst SD-WAN Controller and Manager, to its Known Exploited Vulnerabilities catalog after confirming active exploitation.

Products

Cisco Catalyst SD-WAN ControllerCISA has added CVE-2026-20182, a critical authentication bypass in Cisco Catalyst SD-WAN Controller and Manager, to its Known Exploited Vulnerabilities catalog after confirming active exploitation.

Tools

AdaptixC2Cluster 5 (Active since at least March 13, 2026), which malware agent compiled off the AdaptixC2 red teaming frameworkGSocketCluster 9 (Active since at least March 17, 2026), which deploys an XMRig miner and a peer-based proxying and tunneling tool called gsocketKScanCluster 8 (Active since at least March 10, 2026), which deploys the KScan asset mapping tool and Nim-based backdoor that’s likely based on NimPlant and comes with capabilities to perform file operations, execute filesSliverCluster 6 (Active since at least March 5, 2026), which deploys the Sliver command-and-control (C2) framework

Related Articles