Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Priority CRITICAL 100Exploited in the wildCWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks. A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
Why it matters now
Exploitation Active In CISA KEV since 2026-05-14CISA due date 2026-05-17
EPSS 0.91817 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Catalyst SD-WAN Controller | 20.6.4; 20.9.2; 20.3.6; 20.7.2; 20.7.1; 20.5.1; 20.6.2; 19.3.0; 20.6.1; 17.2.4; 18.2.0; 18.4.6; 19.1.0; 19.2.4; 19.2.929; 18.3.8; 18.4.303; 18.3.7; 18.4.1; 19.2.097; 19.2.0; 19.2.099; 18.3.6; 20.4.2; 19.0.0; 20.9.1; 20.3.5; 20.3.1; 18.3.5; 20.6.3; 18.4.3; 18.4.4; 18.3.3; 17.2.8; 20.8.1; 19.2.32; 19.2.2; 17.2.5; 18.4.0; 20.4.1.1; 20.1.3; 20.1.2; 17.2.10; 19.2.098; 20.1.1; 17.2.6; 19.2.1; 18.3.4; 20.4.1; 17.2.9; 19.2.31; 19.0.1a; 18.3.0; 17.2.7; 18.4.5; 20.3.4; 20.3.3; 20.4.1.2; 20.3.2; 18.3.1; 20.1.12; 19.2.3; 20.10.1; 20.6.5; 20.3.7; 20.9.3; 20.11.1; 20.6.3.2; 20.4.2.3; 20.3.5.1; 20.3.4.3; 20.9.3.1; 20.6.4.1; 20.3.3.2; 20.6.5.2; 20.3.7.1; 20.11.1.1; 20.10.1.1; 20.6.1.2; 20.1.3.1; 20.9.2.2; 20.6.5.3; 20.6.3.3; 20.3.7.2; 20.6.5.4; 20.9.2.3; 20.9.4; 20.12.1; 20.3.8; 20.6.6; 20.12.2; 20.13.1; 20.9.5; 20.12.3; 20.6.7; 20.9.5.1; 20.14.1; 20.12.3.1; 20.12.4; 20.15.1; 20.9.6; 20.6.8; 20.16.1; 20.9.5.3; 20.12.4.1; 20.15.2; 20.12.5; 20.9.7; 20.15.3; 20.12.5.1; 20.12.5.2; 20.15.4; 20.9.7.1; 20.12.6; 20.9.8; 20.15.4.1; 20.15.4.2; 20.12.5.3; 20.12.6.1; 20.9.8.2; 20.15.5; 20.12.7; 20.9.9; 20.15.5.1; 20.15.4.3; 20.15.4.5; 20.15.5.3; 20.12.7.2; 20.9.9.2 | — | No fix listed | CNA |
| Cisco | Cisco Catalyst SD-WAN Manager | 20.1.12; 19.2.1; 18.4.4; 18.4.5; 20.1.1.1; 20.1.1; 19.2.099; 18.3.6; 18.3.7; 19.2.0; 19.1.0; 18.4.303; 19.2.098; 18.3.6.1; 18.2.0; 17.2.8; 18.3.3.1; 18.4.0; 18.3.1; 17.2.6; 17.2.9; 17.2.5; 18.4.0.1; 18.3.3; 18.3.0; 19.2.3; 18.4.501_ES; 20.1.2; 19.2.929; 19.2.31; 20.3.2; 19.2.4; 19.2.4.0.9; 20.1.3.1 | — | No fix listed | CNA |
- Cisco Catalyst SD-WAN Controller VendorCisco Affected 20.6.4; 20.9.2; 20.3.6; 20.7.2; 20.7.1; 20.5.1; 20.6.2; 19.3.0; 20.6.1; 17.2.4; 18.2.0; 18.4.6; 19.1.0; 19.2.4; 19.2.929; 18.3.8; 18.4.303; 18.3.7; 18.4.1; 19.2.097; 19.2.0; 19.2.099; 18.3.6; 20.4.2; 19.0.0; 20.9.1; 20.3.5; 20.3.1; 18.3.5; 20.6.3; 18.4.3; 18.4.4; 18.3.3; 17.2.8; 20.8.1; 19.2.32; 19.2.2; 17.2.5; 18.4.0; 20.4.1.1; 20.1.3; 20.1.2; 17.2.10; 19.2.098; 20.1.1; 17.2.6; 19.2.1; 18.3.4; 20.4.1; 17.2.9; 19.2.31; 19.0.1a; 18.3.0; 17.2.7; 18.4.5; 20.3.4; 20.3.3; 20.4.1.2; 20.3.2; 18.3.1; 20.1.12; 19.2.3; 20.10.1; 20.6.5; 20.3.7; 20.9.3; 20.11.1; 20.6.3.2; 20.4.2.3; 20.3.5.1; 20.3.4.3; 20.9.3.1; 20.6.4.1; 20.3.3.2; 20.6.5.2; 20.3.7.1; 20.11.1.1; 20.10.1.1; 20.6.1.2; 20.1.3.1; 20.9.2.2; 20.6.5.3; 20.6.3.3; 20.3.7.2; 20.6.5.4; 20.9.2.3; 20.9.4; 20.12.1; 20.3.8; 20.6.6; 20.12.2; 20.13.1; 20.9.5; 20.12.3; 20.6.7; 20.9.5.1; 20.14.1; 20.12.3.1; 20.12.4; 20.15.1; 20.9.6; 20.6.8; 20.16.1; 20.9.5.3; 20.12.4.1; 20.15.2; 20.12.5; 20.9.7; 20.15.3; 20.12.5.1; 20.12.5.2; 20.15.4; 20.9.7.1; 20.12.6; 20.9.8; 20.15.4.1; 20.15.4.2; 20.12.5.3; 20.12.6.1; 20.9.8.2; 20.15.5; 20.12.7; 20.9.9; 20.15.5.1; 20.15.4.3; 20.15.4.5; 20.15.5.3; 20.12.7.2; 20.9.9.2 Fixed in — No fix listed CNA
- Cisco Catalyst SD-WAN Manager VendorCisco Affected 20.1.12; 19.2.1; 18.4.4; 18.4.5; 20.1.1.1; 20.1.1; 19.2.099; 18.3.6; 18.3.7; 19.2.0; 19.1.0; 18.4.303; 19.2.098; 18.3.6.1; 18.2.0; 17.2.8; 18.3.3.1; 18.4.0; 18.3.1; 17.2.6; 17.2.9; 17.2.5; 18.4.0.1; 18.3.3; 18.3.0; 19.2.3; 18.4.501_ES; 20.1.2; 19.2.929; 19.2.31; 20.3.2; 19.2.4; 19.2.4.0.9; 20.1.3.1 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* | before 20.9.9.1; 20.10 to before 20.12.5.4; 20.12.6 to before 20.12.6.2; 20.13 to before 20.15.4.4; 20.15.5 to before 20.15.5.2; 20.16 to before 20.18.2.2; 26.1 to before 26.1.1.1 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.7:*:*:*:*:*:*:* | 20.12.7 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:* | before 20.9.9.1; 20.10 to before 20.12.5.4; 20.12.6 to before 20.12.6.2; 20.13 to before 20.15.4.4; 20.15.5 to before 20.15.5.2; 20.16 to before 20.18.2.2; 26.1 to before 26.1.1.1 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:20.12.7:*:*:*:*:*:*:* | 20.12.7 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* | before 20.9.9.1; 20.10 to before 20.12.5.4; 20.12.6 to before 20.12.6.2; 20.13 to before 20.15.4.4; 20.15.5 to before 20.15.5.2; 20.16 to before 20.18.2.2; 26.1 to before 26.1.1.1 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.12.7:*:*:*:*:*:*:* | 20.12.7 | Vulnerable | Cisco |
- cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* Versions before 20.9.9.1; 20.10 to before 20.12.5.4; 20.12.6 to before 20.12.6.2; 20.13 to before 20.15.4.4; 20.15.5 to before 20.15.5.2; 20.16 to before 20.18.2.2; 26.1 to before 26.1.1.1 Vulnerable ·Cisco
- cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.7:*:*:*:*:*:*:* Versions 20.12.7 Vulnerable ·Cisco
- cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:* Versions before 20.9.9.1; 20.10 to before 20.12.5.4; 20.12.6 to before 20.12.6.2; 20.13 to before 20.15.4.4; 20.15.5 to before 20.15.5.2; 20.16 to before 20.18.2.2; 26.1 to before 26.1.1.1 Vulnerable ·Cisco
- cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:20.12.7:*:*:*:*:*:*:* Versions 20.12.7 Vulnerable ·Cisco
- cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* Versions before 20.9.9.1; 20.10 to before 20.12.5.4; 20.12.6 to before 20.12.6.2; 20.13 to before 20.15.4.4; 20.15.5 to before 20.15.5.2; 20.16 to before 20.18.2.2; 26.1 to before 26.1.1.1 Vulnerable ·Cisco
- cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.12.7:*:*:*:*:*:*:* Versions 20.12.7 Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-05-14 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2026-20182
- 2026-10-03 Alias added: GHSA-p83j-mxpw-gqpj
References
More Cisco Catalyst Sd-wan Manager vulnerabilities
- TI-2026-53490 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-16340 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2026-16436 Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability KEVCVSS 3.1HIGH 7.8
- TI-2022-05334 Cisco SD-WAN Software Privilege Escalation Vulnerability KEVCVSS 3.1HIGH 7.8
- TI-2026-16341 Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2026-16346 Information disclosure in Cisco Catalyst SD-WAN Manager KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2026-20182 · CVE Program
- CVE-2026-20182 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-p83j-mxpw-gqpj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences