CVE-2026-20182

The vulnerability results from improper authentication mechanism operation during establishment of control connections (control connection handshaking) between SD-WAN components. An attacker sends specially crafted requests to the vulnerable system, allowing them to log in as an internal user account with high privileges (non-root). After gaining access, the attacker can use the NETCONF interface, which enables manipulation of the network configuration of the entire SD-WAN fabric structure.

An attacker can gain full administrative access to the SD-WAN infrastructure, including the ability to arbitrarily modify network configuration via NETCONF, which threatens the confidentiality, integrity, and availability of the entire network environment.

Apply patches available from the vendor in accordance with the references (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW). The vendor also recommends verifying active control connections using the Show Control Connections command described in the security advisory.

Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart), Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage), and Cisco Catalyst SD-WAN Validator (formerly SD-WAN vBond) — specific versions indicated in vendor references.

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.