CVE-2026-20182 is a peering-authentication bypass affecting the Cisco Catalyst SD-WAN Controller, Manager, and Validator (formerly vSmart/vManage/vBond): because the peering authentication mechanism does not work correctly, an unauthenticated remote attacker can send crafted requests to log in as an internal, high-privileged, non-root account and from there reach NETCONF to rewrite the SD-WAN fabric's configuration, and Cisco has confirmed limited exploitation in the wild.
Vulnerability summary
10
Critical
91.8%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-05-14
Published
Vulnerability ID: CVE-2026-20182 · Source: NVD (Cisco PSIRT Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Cisco Catalyst SD-WAN Manager | cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* | All releases before 20.9.9.1, 20.12.7.1, 20.15.5.2, 20.18.2.2, and 26.1.1.1 (exact fixed release depends on train) across On-Prem, Cloud-Pro, Cloud-Managed, and FedRAMP deployments |
| Cisco Catalyst SD-WAN Controller / Validator | cpe:2.3:a:cisco:sd-wan_vbond_orchestrator_software:*:*:*:*:*:*:*:* | All releases before the fixed versions listed in Cisco advisory cisco-sa-sdwan-rpa2-v69WY2SW |
What this means
CVE-2026-20182 is a second, related vulnerability disclosed after an earlier SD-WAN peering-authentication issue from February 2026, this time in the control-connection handshaking of Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart), Cisco Catalyst SD-WAN Manager (formerly vManage), and Cisco Catalyst SD-WAN Validator (formerly vBond). NVD's description states the peering authentication mechanism "is not working properly," letting an attacker send crafted requests to "log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account," and use that account's NETCONF access to manipulate the SD-WAN fabric's network configuration (NVD).
NVD has not published its own Primary CVSS for this CVE; the only score on record is a Secondary metric submitted by Cisco PSIRT: CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, scope changed, with complete impact to confidentiality, integrity and availability. CWE-287 (Improper Authentication) is the assigned weakness (NVD).
Cisco's own security advisory confirms the same detail, lists fixed releases for every affected train (examples include 20.9.9.1, 20.12.7.1, 20.15.5.2, 20.18.2.2, and 26.1.1.1 depending on the current version), states the flaw affects all deployment types (On-Prem, Cloud-Pro, Cloud-Managed, and FedRAMP), and is explicit that "there are no workarounds that address this vulnerability" — only an upgrade remediates it. The advisory also states Cisco became aware of "limited exploitation of this vulnerability" in May 2026 and strongly recommends immediate patching (Cisco Security Advisory cisco-sa-sdwan-rpa2-v69WY2SW).
CISA added CVE-2026-20182 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-05-14, with a required-action due date of 2026-05-17, and records knownRansomwareCampaignUse as "Unknown" (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.9182 (99.816th percentile), among the highest EPSS scores observed, consistent with a maximum-severity, workaround-free authentication bypass in widely deployed SD-WAN control-plane software (FIRST EPSS).
Because no workaround exists, every Cisco Catalyst SD-WAN Controller, Manager, and Validator instance should be upgraded to the fixed release for its train immediately, and operators should review NETCONF and configuration-change logs for signs of unauthorized access predating the patch.
Evidence
- The peering authentication mechanism in Cisco Catalyst SD-WAN Controller/Manager/Validator does not work properly, letting an unauthenticated remote attacker log in as an internal high-privileged non-root account and reach NETCONF to manipulate the SD-WAN fabric configuration. — NVD
- CVSS v3.1 score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, submitted by Cisco PSIRT and stored by NVD as a Secondary metric — NVD has not published its own Primary score. — NVD
- No workarounds exist; fixed releases include 20.9.9.1, 20.12.7.1, 20.15.5.2, 20.18.2.2, and 26.1.1.1 depending on train, across all deployment types. Cisco observed limited exploitation in May 2026. — Cisco Security Advisory cisco-sa-sdwan-rpa2-v69WY2SW
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-05-14, required action due 2026-05-17; knownRansomwareCampaignUse recorded as "Unknown". — CISA KEV
- EPSS score is 0.9182 (99.816th percentile) as of 2026-10-30. — FIRST EPSS
