dbcve.org
Actively exploited in the wild. This CVE is on the CISA Known Exploited Vulnerabilities list — treat remediation as urgent. Federal remediation due by 17 May 2026.
Catalyst Sd Wan ManagerApplication · Cisco

CVE-2026-20182

CRITICAL · 10.0 CVSS v3.1 Published 2026-05-14
Fix available
A fix is available. Upgrade to 20.9.9.1 / 20.12.5.4 or later.
See remediation →
100/100
Remediation priority · Urgent
In the wild High EPSS Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.  A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

This is an authentication bypass vulnerability in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller, Manager, and Validator. An unauthenticated remote attacker can send crafted requests to bypass authentication and gain access as an internal high-privileged non-root user account. The attacker can then access NETCONF to manipulate the SD-WAN fabric configuration.

MitigationApply the vendor patch/fix provided in the Cisco security advisory for this vulnerability. Until patched, monitor control connections using the Show Control Connections guidance mentioned in the advisory and restrict NETCONF access at network boundaries.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Catalyst Sd Wan ManagerApplication
Affected:< 20.9.9.1>= 20.10, < 20.12.5.4>= 20.12.6, < 20.12.6.2>= 20.13, < 20.15.4.4>= 20.15.5, < 20.15.5.2>= 20.16, < 20.18.2.2>= 26.1, < 26.1.1.1= 20.12.7
Sd Wan Vbond OrchestratorApplication
Affected:< 20.9.9.1>= 20.10, < 20.12.5.4>= 20.12.6, < 20.12.6.2>= 20.13, < 20.15.4.4>= 20.15.5, < 20.15.5.2>= 20.16, < 20.18.2.2>= 26.1, < 26.1.1.1= 20.12.7
Sd Wan Vsmart ControllerApplication
Affected:< 20.9.9.1>= 20.10, < 20.12.5.4>= 20.12.6, < 20.12.6.2>= 20.13, < 20.15.4.4>= 20.15.5, < 20.15.5.2>= 20.16, < 20.18.2.2>= 26.1, < 26.1.1.1= 20.12.7

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify running SD-WAN components
    Log into the SD-WAN CLI or management interface and run commands to list installed components: 'show version' or check the management UI for installed modules. Identify if Cisco Catalyst SD-WAN Manager, Vbond Orchestrator, or Vsmart Controller are running.
    Affected if Any of the three affected components (Manager, Vbond, Vsmart) are present in the environment
  2. Determine installed version
    Run 'show version' in the SD-WAN CLI or check the About/Version page in the SD-WAN Manager web interface. Note the exact version number (for example: 20.12.5.3, 20.15.4, 26.1.0.0)
    Affected if The installed version matches any of the affected ranges: < 20.9.9.1; >= 20.10, < 20.12.5.4; >= 20.12.6, < 20.12.6.2; >= 20.13, < 20.15.4.4; >= 20.15.5, < 20.15.5.2; >= 20.16, < 20.18.2.2; >= 26.1, < 26.1.1.1; or equals 20.12.7
  3. Review admin user accounts
    Access the SD-WAN Manager UI, navigate to Administration > User Management, or run 'show users' in the CLI. Look for any unexpected admin accounts, especially accounts with high-privileged non-root access that were not created by your organization.
    Affected if Unexpected admin accounts exist, particularly high-privilege accounts of unknown origin
  4. Check NETCONF access logs
    Review NETCONF logs or audit logs for the SD-WAN components. Look for NETCONF session initiations from unexpected IP addresses, or configuration change events that were not initiated by legitimate administrators.
    Affected if NETCONF sessions or configuration changes are logged from unknown sources or at unexpected times
  5. Inspect peering authentication configuration
    In the SD-WAN Manager UI, navigate to the peering or authentication settings (typically under Configuration > Security). Verify that peering authentication is enabled and configured as expected. Check for any anomalous or disabled authentication settings.
    Affected if Peering authentication is disabled, misconfigured, or shows signs of modification

Your environment is affected if any Cisco Catalyst SD-WAN Manager, Vbond Orchestrator, or Vsmart Controller is running a version within the affected ranges AND the peering authentication mechanism can be bypassed, allowing unauthenticated attackers to gain admin access to NETCONF.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 20.9.9.1 / 20.12.5.4 / 20.12.6.2 or later
Fixed in 20.9.9.120.12.5.420.12.6.2
Interim mitigation

Apply the vendor patch/fix provided in the Cisco security advisory for this vulnerability. Until patched, monitor control connections using the Show Control Connections guidance mentioned in the advisory and restrict NETCONF access at network boundaries.

Recommended fix High confidence

20.15.4.4 or later (recommended latest stable release)

  1. 1. Identify the current version of Cisco Catalyst SD-WAN running in your environment (Manager, vBond, or vSmart)
  2. 2. For SD-WAN Manager: Upgrade to version 20.9.9.1 or higher, or 20.12.5.4 or higher, or 20.12.6.2 or higher, or 20.15.4.4 or higher
  3. 3. For SD-WAN vBond Orchestrator: Upgrade to version 20.9.9.1 or higher, or 20.12.5.4 or higher, or 20.12.6.2 or higher, or 20.15.4.4 or higher
  4. 4. For SD-WAN vSmart Controller: Upgrade to version 20.9.9.1 or higher, or 20.12.5.4 or higher, or 20.12.6.2 or higher, or 20.15.4.4 or higher
  5. 5. After upgrade, verify control connections using 'show control connections' command to confirm system integrity
  6. 6. Review administrative accounts and NETCONF access permissions for any unauthorized changes
Caveat Review Cisco SD-WAN upgrade guide for migration considerations between major releases

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Catalyst Sd Wan Manager Exploited in the wild — priority engagement
  • Consultation8.0 h
  • Implementation16.0 h
  • Testing24.0 h
  • Review / QA12.0 h
60.0 hours of engineering $10,240
Get it fixed fast

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $16,384.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-20182 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-20182 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data