Second Cisco SD-WAN authentication bypass exploited in zero-day attacks

Cisco on May 14, 2026, disclosed a second maximum-severity authentication bypass in its Catalyst SD-WAN Controller and Manager that attackers had exploited as a zero-day. The Canadian Centre for Cyber Security issued alert AL26-012 the next day, citing incidents in which intruders added SSH keys, modified NETCONF configurations and escalated to root.

The disclosure came less than three months after Cisco patched CVE-2026-20127, a similar flaw in the same peering authentication process that was used to plant rogue peers in victims' networks. Organizations that patched in February are still exposed to the new bug.

What happened

According to Cisco's advisory, CVE-2026-20182 lies in the control connection handshake. An unauthenticated, remote attacker can bypass authentication and obtain administrative privileges. Cisco rated it 10.0. It affects every deployment type, regardless of configuration.

Rapid7 found the flaw while researching the February bug, BleepingComputer reported. An attacker can log in as an internal high-privileged account and reach NETCONF to manipulate the SD-WAN fabric. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on May 14 and gave U.S. federal agencies until May 17 to patch.

The Cyber Centre's alert also noted Cisco's warning about continued exploitation of three older SD-WAN Manager flaws, CVE-2026-20133, CVE-2026-20128 and CVE-2026-20122.

If an unknown IP address authenticated successfully, Cisco's guidance is to treat the device as compromised and open a case with its Technical Assistance Center. Restricting access to management interfaces can reduce exposure in the meantime but does not fix the flaw.

Fixed versions

Fixes include 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.12.7.1, 20.15.4.4, 20.15.5.2, 20.18.2.2 and 26.1.1.1. Cisco-managed SD-WAN Cloud was fixed in release 20.15.506 with no customer action needed. Cisco says there are no workarounds.

What to do

• Before upgrading, run the request admin-tech command on each control component to preserve possible evidence, as Cisco advises.
• Upgrade to a fixed release.
• Check /var/log/auth.log for accepted public key logins for vmanage-admin from unknown IP addresses, and look for unauthorized peering events.
• Restrict management and control-plane interfaces to trusted addresses and follow Cisco's SD-WAN hardening guide.

Suspected compromises can be reported to the Cyber Centre through My Cyber Portal.