Cisco Catalyst SD-WAN Manager up to 20.3.2 improper authentication

Summaryinfo

A vulnerability was found in Cisco Catalyst SD-WAN Manager and classified as critical. This issue affects some unknown processing. The manipulation results in improper authentication. This vulnerability is identified as CVE-2026-20182. The attack can be executed remotely. Additionally, an exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as very critical has been found in Cisco Catalyst SD-WAN Manager. Affected is an unknown code. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.  A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

The advisory is available at sec.cloudapps.cisco.com. This vulnerability is traded as CVE-2026-20182 since 10/08/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but an exploit is available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/16/2026).

It is declared as attacked. This issue was added on 05/14/2026 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 05/17/2026:

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL li

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Zero-Day.cz (1097) and CERT Bund (WID-SEC-2026-1534). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Cisco Catalyst

Productinfo

Type

• Network Management Software

Vendor

• Cisco

Name

• Catalyst SD-WAN Manager

Version

• 17.2.5
• 17.2.6
• 17.2.8
• 17.2.9
• 18.2.0
• 18.3.0
• 18.3.1
• 18.3.3
• 18.3.3.1
• 18.3.6
• 18.3.6.1
• 18.3.7
• 18.4.0
• 18.4.0.1
• 18.4.4
• 18.4.5
• 18.4.303
• 18.4.501_ES
• 19.1.0
• 19.2.0
• 19.2.098
• 19.2.099
• 19.2.1
• 19.2.3
• 19.2.4
• 19.2.4.0.9
• 19.2.31
• 19.2.929
• 20.1.1
• 20.1.1.1
• 20.1.2
• 20.1.3.1
• 20.1.12
• 20.3.2

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion