Cisco Catalyst SD-WAN Peering Authentication Bypass (CVE-2026-20182)

Cisco says a flaw in the peering authentication of Catalyst SD-WAN lets an unauthenticated, remote attacker bypass authentication and obtain administrative privileges. On a Controller, the attacker can log in as an internal, high-privileged, non-root user account. That account can reach NETCONF, which lets the attacker change the network configuration of the SD-WAN fabric.

Catalyst SD-WAN is Cisco's software-defined WAN platform. Its control plane has three parts: the Controller (formerly vSmart), the Manager (formerly vManage) and the Validator (formerly vBond). Devices and controllers join the fabric through a control connection handshake, and this flaw sits in that handshake.

How CVE-2026-20182 Differs From CVE-2026-20127

Cisco describes this as a new vulnerability in the control connection handshaking, discovered and fixed after an earlier Controller authentication bypass was disclosed in February 2026. Rapid7, which reported it, says it found the flaw while researching CVE-2026-20127, the earlier Cisco SD-WAN authentication bypass.

Rapid7 says the new issue is not a patch bypass of CVE-2026-20127. It is a different bug in a similar part of the same vdaemon networking stack. Both flaws sit in the service that handles control-plane peering over DTLS on UDP port 12346, and Rapid7 says the impact is the same.

Cisco tracks CVE-2026-20182 in its own advisory with its own fixed releases. Check each CVE separately when you plan upgrades. Our Cisco SD-WAN exploitation incident page covers the wider attacks on this platform.

Where the Handshake Breaks

Rapid7 says vdaemon applies certificate checks according to the device type that a connecting peer claims. Its analysis shows verification code for vEdge, vSmart and vManage peers, but none for the vHub device type. A peer that claims to be a vHub is therefore marked authenticated without a valid credential.

Rapid7 says an attacker in that state can inject its own public key into the authorized SSH keys of the vmanage-admin account. The attacker can then sign in to NETCONF over SSH on TCP port 830. Cisco's indicator guidance matches this path: it asks admins to audit auth.log for accepted public key logins by vmanage-admin from unknown IP addresses.

Which Deployments Are Affected

Cisco says the flaw affects the Controller, the Manager and the Validator, regardless of system configuration. That covers on-prem deployments, Cisco SD-WAN Cloud-Pro, Cisco-managed Cloud and the FedRAMP offering. Cisco added the Validator in version 2.0 of the advisory, dated 16 June 2026.

Cisco also says Controllers with ports exposed to the internet are at risk of compromise. Rapid7 lists TCP 22, TCP 830 and UDP 12346 as the network-reachable services of a Controller, depending on configuration. Cisco lists no workaround.

Exploitation Signals for CVE-2026-20182

These are the public signals we checked on 4 November 2026. Each row names who says it.

Of the three repositories, the README of the earliest, created on 22 May, presents a proof of concept for the peering bypass. Another describes itself as an assessment tool for authorized testing, and the third holds only a generic template with placeholder text. We do not link them. Rapid7 also says it added a link to a Metasploit module to its post on 15 May.

The Blackhole posts are Telegram channel items. Two on 16 June are about CVE-2026-20182 itself, one an automated CVE alert and one a monthly vulnerability digest. The other seven mention it while covering CVE-2026-20127, CVE-2026-20245 or other Cisco news.

Cisco credits Stephen Fewer and Jonah Burgess of Rapid7 for reporting the flaw. Rapid7 says it first contacted Cisco on 9 March 2026. Our vulnerability management guide covers how to plan and check an upgrade.

Cisco lists the Controller, Manager and Validator as vulnerable and gives one fixed-release table for all three. NVD records the same fixed versions for the Manager, the Validator and the Controller. The table below follows Cisco's advisory row by row.

Cisco marks the releases earlier than 20.9, plus 20.11, 20.13, 20.14 and 20.16, as having reached end of software maintenance. It strongly encourages customers on those trains to move to a supported release. The advisory says Cisco validates only the affected and fixed release information it documents.

Cisco says it has also addressed the flaw in Cisco SD-WAN Cloud (Cisco Managed) release 20.15.506, and that no user action is required there. Cisco Cloud-Pro, on-prem and FedRAMP deployments are listed as affected, so check their release numbers against the table. Our vulnerability management 101 guide explains how to track fixes across versions.

Before upgrading, Cisco tells customers to run the request admin-tech command on each control component to preserve possible indicators of compromise. After upgrading, check the logs for the indicators in the advisory. Cisco says that if a system is confirmed compromised, the update alone will not resolve the problem and Cisco TAC remediation steps apply.