DaystoPatch

CiscoExploited incident

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (control connection handshaking, May 2026)

CVE-2026-20182Critical, CVSS 10.0In CISA's Known Exploited Vulnerabilities catalog since 14 May 2026

  • Exploited before a fix
FixedFixed for every supported version under an hour after the first public report.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
<1h
First public report to first fix
Follow-through
<1h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco advisory cisco-sa-sdwan-rpa2-v69WY2SWClaimedQuote verified

    Initial public release.

    Vendor advisory was the first public report.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0f7f66e519a0301b…
    Used in metrics
    Yes
    Dispute this timestamp
    8 more sources for this moment
    CISA KEV (CVE-2026-20182)ClaimedQuote verified14 May 2026

    Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

    Added to CISA's KEV catalog on 2026-05-14.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-sdwan-rpa2-v69WY2SWClaimedQuote verified14 May 2026, 16:00 UTC

    Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:db5d834c8b3bfc73…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco PSIRT advisory cisco-sa-sdwan-rpa2-v69WY2SW, v1.0 (Wayback snapshot 2026-05-14)CuratedQuote verified14 May 2026, 16:00 UTC

    In May 2026, the Cisco Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability.

    Exploitation disclosed in v1.0 ('First Published: 2026 May 14 16:00 GMT'). No earlier public report found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5b32788bfdd3abb3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-20182ClaimedQuote verified14 May 2026, 16:08 UTC

    May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f747e48609c12a3b…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet14 May 2026, 16:17 UTC

    https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet14 May 2026, 19:36 UTC

    Cisco SD-WAN Flaw Actively Exploited for Admin Access Cisco is urging customers to update their SD-WAN systems immediately due to a critical vulnerability that allows hackers to bypass

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet14 May 2026, 21:20 UTC

    https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-...

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Research: gtiClaimedQuote verified24 Jun 2026

    Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager

    Earliest mention we hold (a vetted outlet).

    Source
    Research: gti research
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1795a465fad9f52e…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco advisory cisco-sa-sdwan-rpa2-v69WY2SWClaimedQuote verified

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0f7f66e519a0301b…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco PSIRT advisory cisco-sa-sdwan-rpa2-v69WY2SWCuratedQuote not checked yet14 May 2026, 16:00 UTC

    First Published: 2026 May 14 16:00 GMT

    Cisco's CSAF gives revision 1.0.0 as 2026-05-14T15:56:13+00:00. The live page's revision table now dates 1.0 as 2026-MAY-27 (the v1.0 snapshot shows 2026-MAY-14); we use the First Published header and the snapshot.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    +<1h

    Cisco PSIRT advisory cisco-sa-sdwan-rpa2-v69WY2SW, v1.0 (Wayback snapshot 2026-05-14)CuratedQuote verified

    Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5b32788bfdd3abb3…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    +<1h

    Cisco PSIRT advisory cisco-sa-sdwan-rpa2-v69WY2SW, v1.0 (Wayback snapshot 2026-05-14)CuratedQuote verified

    First Published: 2026 May 14 16:00 GMT

    The v1.0 table already lists a fix for every supported train (20.9.9.1; 20.12.5.4, 20.12.6.2, 20.12.7.1; 20.15.4.4, 20.15.5.2; 20.18.2.2; 26.1.1.1); end-of-maintenance trains must migrate. Later revisions (1.1 on 2026-05-27, 2.0 on 2026-06-16 adding SD-WAN Validator to the affected products) did not change fixed releases.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5b32788bfdd3abb3…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. cisco-sa-sdwan-rpa2-v69WY2SW

    Recorded in the revision history

    Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

    Revision 1.0 date changed from 2026-05-14 to 2026-05-27.

    • Revision date changed
    Revision 1.0 date
    Before2026-05-14
    After2026-05-27
    Earlier version captured 16 May 2026, 20:36 UTC: archived copyLater version captured 3 Jun 2026, 14:51 UTC: archived copyRecovered from archived copiesSnapshots e27fbad9bd… and 25aaf4c4cb…Incident page

Send this to your boss

Cisco SD-WAN controller authentication bypass exploited; fixes for all trains

Attackers have exploited a maximum-severity flaw that lets an unauthenticated attacker log in to Cisco Catalyst SD-WAN control components with high privileges; Cisco shipped fixes when it disclosed it.

In plain words

Cisco's SD-WAN controllers, which tell all of our branch routers how to route traffic, had a flaw that let an outsider log in with high privileges and change the network's configuration, and Cisco confirmed limited real-world attacks. Cisco released fixes for all supported versions on 14 May 2026, the day it announced the problem. If we run these controllers ourselves, we need to save diagnostic logs, upgrade, and then check for signs of tampering. Cisco's managed cloud service has already been fixed.

What happened and who is affected

What happened

On 14 May 2026 Cisco disclosed CVE-2026-20182, a flaw in the peering authentication of Cisco Catalyst SD-WAN Controller, Manager and Validator, scored 10.0. An unauthenticated attacker can log in as an internal high-privileged account and use NETCONF to change the configuration of the SD-WAN fabric. Cisco said it was aware of limited exploitation and published fixed releases for every supported train the same day. It is a new bug, found after an earlier SD-WAN controller authentication bypass disclosed in February 2026.

Who is affected

Self-managed Cisco Catalyst SD-WAN Controller (vSmart), Manager (vManage) and Validator (vBond) on releases before 20.9.9.1, 20.12.5.4 / 20.12.6.2 / 20.12.7.1, 20.15.4.4 / 20.15.5.2, 20.18.2.2 and 26.1.1.1; trains earlier than 20.9 and other end-of-maintenance trains must migrate. Cisco SD-WAN Cloud (Cisco Managed) is fixed in 20.15.506.

CVE-2026-20182. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/cisco-cve-2026-20182/

Affected products

  • Cisco Catalyst SD-WAN Controller
  • Cisco Catalyst SD-WAN Manager
  • Cisco Catalyst SD-WAN Validator
  • Cisco SD-WAN Cloud (Cisco Managed)
How we built this timeline

Exploitation disclosed in the same advisory that shipped fixes, so world = vendor = First fix = Fixed for all versions. Reported by Stephen Fewer and Jonah Burgess of Rapid7.

Follows the February 2026 SD-WAN controller authentication bypass (cisco-cve-2026-20127). Cisco data inconsistency: the live revision table dates both 1.0 and 1.1 as 2026-MAY-27, while the header, the CSAF (1.0.0 at 2026-05-14T15:56:13+00:00) and the v1.0 Wayback snapshot give 14 May 2026.

Related

Cisco report card