Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

98
Patch now
CRITICAL 10.0EXPLOITEDREMOTEUPGRADEUPGRADEUPGRADE

CVE-2026-20182 is a critical-severity flaw (CVSS 10.0) affecting catalyst sd-wan manager, sd-wan vbond orchestrator, sd-wan vsmart controller, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.  A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, former

Why this priority

  • Critical severity
  • EPSS top 1%: very likely to be exploited
  • Exploited in the wild (CISA KEV)
  • Public exploit reference
  • CISA SSVC: automatable with total technical impact
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score10.0 (Critical)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance91.8% (top 1%)
CISA exploited listYes, fix due 2026-05-17
WeaknessCWE-287
Published2026-05-14
Last modified2026-10-26
Publisher (CNA): Cisco Systems, Inc. · Vendor: cisco

Share: LinkedIn · X · Reddit

Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

cisco catalyst sd-wan manager UPGRADE
Affected: < 20.9.9.1 · >= 20.10 and < 20.12.5.4 · >= 20.12.6 and < 20.12.6.2 · >= 20.13 and < 20.15.4.4 · >= 20.15.5 and < 20.15.5.2 · >= 20.16 and < 20.18.2.2 · >= 26.1 and < 26.1.1.1 · 20.12.7
Fixed in: 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1
Safe to downgrade to: a release before 20.10
1. Check installed version
apt-cache policy catalyst-sd-wan-manager || rpm -q catalyst-sd-wan-manager || catalyst-sd-wan-manager --version
2. UPGRADE to 20.9.9.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade catalyst-sd-wan-manager
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade catalyst-sd-wan-manager
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 20.10 (Debian / Ubuntu)
apt-cache madison catalyst-sd-wan-manager sudo apt install catalyst-sd-wan-manager=<VERSION_BEFORE_20.10> sudo apt-mark hold catalyst-sd-wan-manager
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list catalyst-sd-wan-manager sudo dnf downgrade catalyst-sd-wan-manager-<VERSION_BEFORE_20.10> sudo dnf versionlock add catalyst-sd-wan-manager
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
cisco sd-wan vbond orchestrator UPGRADE
Affected: < 20.9.9.1 · >= 20.10 and < 20.12.5.4 · >= 20.12.6 and < 20.12.6.2 · >= 20.13 and < 20.15.4.4 · >= 20.15.5 and < 20.15.5.2 · >= 20.16 and < 20.18.2.2 · >= 26.1 and < 26.1.1.1 · 20.12.7
Fixed in: 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1
Safe to downgrade to: a release before 20.10
1. Check installed version
apt-cache policy sd-wan-vbond-orchestrator || rpm -q sd-wan-vbond-orchestrator || sd-wan-vbond-orchestrator --version
2. UPGRADE to 20.9.9.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade sd-wan-vbond-orchestrator
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade sd-wan-vbond-orchestrator
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 20.10 (Debian / Ubuntu)
apt-cache madison sd-wan-vbond-orchestrator sudo apt install sd-wan-vbond-orchestrator=<VERSION_BEFORE_20.10> sudo apt-mark hold sd-wan-vbond-orchestrator
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list sd-wan-vbond-orchestrator sudo dnf downgrade sd-wan-vbond-orchestrator-<VERSION_BEFORE_20.10> sudo dnf versionlock add sd-wan-vbond-orchestrator
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
cisco sd-wan vsmart controller UPGRADE
Affected: < 20.9.9.1 · >= 20.10 and < 20.12.5.4 · >= 20.12.6 and < 20.12.6.2 · >= 20.13 and < 20.15.4.4 · >= 20.15.5 and < 20.15.5.2 · >= 20.16 and < 20.18.2.2 · >= 26.1 and < 26.1.1.1 · 20.12.7
Fixed in: 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1
Safe to downgrade to: a release before 20.10
1. Check installed version
apt-cache policy sd-wan-vsmart-controller || rpm -q sd-wan-vsmart-controller || sd-wan-vsmart-controller --version
2. UPGRADE to 20.9.9.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade sd-wan-vsmart-controller
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade sd-wan-vsmart-controller
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 20.10 (Debian / Ubuntu)
apt-cache madison sd-wan-vsmart-controller sudo apt install sd-wan-vsmart-controller=<VERSION_BEFORE_20.10> sudo apt-mark hold sd-wan-vsmart-controller
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list sd-wan-vsmart-controller sudo dnf downgrade sd-wan-vsmart-controller-<VERSION_BEFORE_20.10> sudo dnf versionlock add sd-wan-vsmart-controller
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Advisories and coverage

Research and news

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-20182?

catalyst sd-wan manager: upgrade to 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1; sd-wan vbond orchestrator: upgrade to 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1; sd-wan vsmart controller: upgrade to 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1. Exact commands for each OS are on this page.

Is CVE-2026-20182 being exploited?

Yes. CVE-2026-20182 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2026-20182 affect?

CVE-2026-20182 affects catalyst sd-wan manager, sd-wan vbond orchestrator, sd-wan vsmart controller. Severity is critical (CVSS 10.0). May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection ha

How urgent is CVE-2026-20182?

Priority 98/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

Cisco vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.