CVE-2026-20182

CRITICALCISA KEVNuclei

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-20182 has a selected CVSS score of 10.0 (critical); EIP currently links 1 catalogued exploit, 3 repository PoCs, 1 curated repository PoC, and 1 Nuclei template. CISA lists CVE-2026-20182 in KEV.

Description

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.  A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · May 14, 2026 · CISA
VulnCheck KEV
Listed · May 14, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Repository PoCs
3
Curated repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationActive
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 14, 2026 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

Catalyst SD-WAN

Browse Cisco / Catalyst SD-WAN
CISAVersion data not supplied

Cisco Catalyst SD-WAN Controller

Browse Cisco / Cisco Catalyst SD-WAN Controller

Default status: unknown

CVE List20.6.4affected
20.9.2affected
20.3.6affected
20.7.2affected
20.7.1affected
20.5.1affected
20.6.2affected
19.3.0affected
20.6.1affected
17.2.4affected
18.2.0affected
18.4.6affected
Showing 12 of 129 version ranges

Cisco Catalyst SD-WAN Manager

Browse Cisco / Cisco Catalyst SD-WAN Manager

Default status: unknown

CVE List20.1.12affected
19.2.1affected
18.4.4affected
18.4.5affected
20.1.1.1affected
20.1.1affected
19.2.099affected
18.3.6affected
18.3.7affected
19.2.0affected
19.1.0affected
18.4.303affected
Showing 12 of 34 version ranges

Proofs of concept

5

Catalogued exploits

MetasploitCisco Catalyst SD-WAN Controller vHub Authentication BypassMetasploit auxiliary PoCby Crypto-Cat +1 moreExploit1 file

Ruby

Metasploit
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This Metasploit auxiliary module exploits CVE-2026-20182, an authentication bypass in Cisco Catalyst SD-WAN Controller. It performs a DTLS handshake with a self-signed certificate, sends a CHALLENGE_ACK claiming to be a vHub (device type 2) to bypass authentication, and then injects an attacker-controlled SSH public key into the vmanage-admin user's authorized_keys file via a VMANAGE_TO_PEER message, providing persistent SSH access.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a documented authentication bypass exploit (CVE-2026-20182) against Cisco Catalyst SD-WAN Controller. It performs a DTLS handshake with a self-signed certificate, sends a crafted CHALLENGE_ACK claiming to be a vHub device to bypass authentication, and optionally injects an SSH public key into the vmanage-admin user's authorized_keys file for persistent NETCONF access. All behavior is consistent with the stated exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareCisco Catalyst SD-WAN Controller
Attack typesauthentication_bypassssh_key_injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module actively exploits the vulnerability by performing the authentication bypass and then injecting an SSH key to gain persistent access, which goes beyond mere detection or scanning.

modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:86-101modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:105-134

Requirements

  • Network access to the target's UDP port 12346 (vdaemon DTLS control-plane service).modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:64
  • OpenSSL libraries available on the attacker's system for DTLS handshake via FFI.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:538-574

Observed behavior

  • Performs a DTLS handshake using a self-signed certificate without verifying the server's certificate.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:136-195
  • Sends a CHALLENGE_ACK message with device type set to vHub (2) to trigger the authentication bypass.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:215-222
  • Injects an SSH public key into the vmanage-admin user's authorized_keys file via a VMANAGE_TO_PEER message.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:266-311
  • Provides instructions to connect to the NETCONF service (TCP port 830) using the injected SSH key.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:278-296
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThe module sends a CHALLENGE_ACK message with device type 2 (vHub) to bypass authentication, as described in the module metadata and CVE context.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:215-222
Exploit Behavior
Payload withheldThe module builds and sends a VMANAGE_TO_PEER message containing an attacker-controlled SSH public key, providing persistent access to the target's NETCONF service.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:266-311
Exploit Behavior
Payload withheldThe module generates an in-memory self-signed certificate and performs a DTLS handshake without verifying the server's certificate, as required for the exploit.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:136-195
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided module source code and metadata; the code was not executed, and its effectiveness or safety is not verified.
  • The evidence does not include the framework mixins, libraries, or external payloads referenced by the module, so the full runtime behavior cannot be assessed.
  • Only the module source code and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
  • Binary files were not inspected (none present in evidence).
  • The review does not assess the safety or reliability of the exploit against production systems.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Curated repository PoCs

GitHubCVE-2026-20182Curated repository PoCby SecureWithUmer34Exploit2 files

C++ · 13.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2026-20182 that bypasses authentication on Cisco Catalyst SD-WAN Controller/Manager by sending crafted DTLS messages claiming to be a vHub (device_type=2), then injects an SSH public key for persistent NETCONF/SSH access.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a README and a Python script that implement the documented CVE-2026-20182 authentication bypass. The script performs a DTLS handshake, sends crafted messages to bypass authentication, and injects an SSH public key for NETCONF/SSH access. All behavior aligns with the stated exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm is present.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareCisco Catalyst SD-WAN ControllerCisco Catalyst SD-WAN Manager
Attack typesauthentication_bypassssh_key_injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete Python script (cve-2026-20182.py) that actively exploits CVE-2026-20182 by sending crafted DTLS messages to bypass authentication and inject an SSH key for remote access. The README explicitly describes it as a 'proof-of-concept exploit' and details the exploitation steps. The code performs the attack, not just detection or scanning.

portbuster1337-CVE-2026-20182-a75f627/README.md:3portbuster1337-CVE-2026-20182-a75f627/README.md:15-22portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:1-13portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:74-168

Requirements

  • Target must be running a vulnerable version of Cisco Catalyst SD-WAN Controller or Manager with the vdaemon service exposed on UDP/12346.portbuster1337-CVE-2026-20182-a75f627/README.md:3portbuster1337-CVE-2026-20182-a75f627/README.md:67-81
  • Attacker must have network connectivity to the target's vdaemon UDP port (default 12346).portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:175-176
  • Python 3.7+, openssl CLI, and the cryptography library are required to run the exploit.portbuster1337-CVE-2026-20182-a75f627/README.md:111-113

Observed behavior

  • Establishes a DTLS 1.2 connection to the target's vdaemon service on UDP/12346.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:79-84
  • Receives the CHALLENGE message (msg_type=8) from the server.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:105-108
  • Sends a crafted CHALLENGE_ACK message with device_type=2 (vHub) to bypass certificate verification and set peer->authenticated = 1.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:44-47portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:114-116
  • Sends a HELLO message (msg_type=5) to transition the peer to UP state.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:50-51portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:144-146
  • Injects an SSH public key into /home/vmanage-admin/.ssh/authorized_keys via a MSG_VMANAGE_TO_PEER message (msg_type=14).portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:54-57portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:162-164
  • Optionally verifies exploitation by connecting to NETCONF (SSH TCP/830) as vmanage-admin using the injected key.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:199-234
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Ssh Key Injection
Payload withheldThis is the documented post-exploitation step to gain persistent access, consistent with the vulnerability description.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:54-57portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:162-165
Network Connection
Payload withheldStandard exploit behavior for the described vulnerability.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:79-84portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:200-211
Key Generation
Payload withheldSupports the documented SSH key injection step.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:60-71portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:187-194
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied text files; no binary analysis or runtime execution was performed.
  • The exploit relies on the openssl CLI for DTLS transport, which may have environment-specific dependencies not verified here.
  • Only the two supplied text files (README.md and cve-2026-20182.py) were reviewed; no other files exist in the artifact.
  • The script uses the openssl CLI subprocess for DTLS transport, which is a legitimate dependency for the exploit but could be abused if the openssl binary were compromised—no evidence of such compromise is present.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubportbuster1337/CVE-2026-20182Repository PoCby portbuster13373Exploit2 files

13.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2026-20182 that bypasses authentication on Cisco Catalyst SD-WAN Controller/Manager by sending crafted DTLS messages claiming to be a vHub (device_type=2), then injects an SSH public key for persistent NETCONF/SSH access.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2026-20182. The script performs the documented authentication bypass and SSH key injection against the stated Cisco SD-WAN target. No concealed, deceptive, or unrelated harmful behavior was observed. The script's actions are consistent with the described exploit and do not exhibit backdoor or trojan characteristics.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareCisco Catalyst SD-WAN ControllerCisco Catalyst SD-WAN Manager
Attack typesauthentication bypassprivilege escalationremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, executable Python script (cve-2026-20182.py) that actively exploits CVE-2026-20182 by sending crafted DTLS messages to bypass authentication and inject an SSH key for remote access. The README explicitly describes it as a 'proof-of-concept exploit' and details the exploitation steps.

README.md:3cve-2026-20182.py:1-13cve-2026-20182.py:74-168

Requirements

  • Python 3.7+ with cryptography library and openssl CLIREADME.md:111-113
  • Network access to target UDP port 12346 (vdaemon DTLS service)README.md:17

Observed behavior

  • Establishes DTLS 1.2 connection to target vdaemon service on UDP/12346cve-2026-20182.py:79-84
  • Receives CHALLENGE message (msg_type=8) from servercve-2026-20182.py:105-111
  • Sends CHALLENGE_ACK with device_type=2 (vHub) to bypass certificate verificationcve-2026-20182.py:44-47cve-2026-20182.py:114-116
  • Sends HELLO message to transition peer to UP statecve-2026-20182.py:50-51cve-2026-20182.py:144-146
  • Injects SSH public key into vmanage-admin authorized_keys via MSG_VMANAGE_TO_PEERcve-2026-20182.py:54-57cve-2026-20182.py:162-164
  • Optionally verifies exploitation by connecting to NETCONF over SSH on port 830cve-2026-20182.py:199-234
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldAll actions match the documented vulnerability exploitation steps and target the specified Cisco SD-WAN service.cve-2026-20182.py:39-57cve-2026-20182.py:74-168
Network Target
Payload withheldThe script connects only to the user-supplied target on the documented vulnerable service port.cve-2026-20182.py:79-80
Payload
Payload withheldThe injected key provides the documented NETCONF/SSH access as the vmanage-admin user; no other payloads or persistence mechanisms are present.cve-2026-20182.py:54-57README.md:21-22
Review boundaries

What the analysis did not establish

  • Review is limited to the supplied text files (README.md and cve-2026-20182.py). No binary files were present. The script's runtime behavior was not dynamically analyzed; static analysis cannot guarantee the absence of logic bombs or environment-dependent behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubHORKimhab/CVE-2026-20182Repository PoCby HORKimhab0Exploit6 files

23.9 KiB

GitHub
PoC details
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains two distinct Python exploit scripts for CVE-2026-20182, a critical authentication bypass in Cisco Catalyst SD-WAN Controller/Manager. The primary script (cve-2026-20182.py) performs a DTLS handshake, sends a crafted CHALLENGE_ACK with device_type=2 to bypass authentication, and injects an SSH public key for persistent NETCONF/SSH access. A secondary script (cve-2026-20182-poc.py) also attempts the bypass and includes a reverse shell payload.

Backdoor review

Suspicious behavior

The repository contains two distinct PoC scripts for CVE-2026-20182. The first script (cve-2026-20182.py) is a straightforward exploit that injects an SSH key. The second script (cve-2026-20182-poc.py) materially misrepresents its behavior: it claims to be a PoC for the CVE but its primary payload includes a reverse shell that connects back to an attacker-controlled listener, a feature that is not disclosed in the repository's own README or the script's help text. This concealment of a core, operator-targeting function creates a positive concern.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareCisco Catalyst SD-WAN ControllerCisco Catalyst SD-WAN Manager
Attack typesauthentication bypassremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a functional Python script that actively exploits CVE-2026-20182 by performing a DTLS handshake, sending crafted messages to bypass authentication, and injecting an SSH key to gain persistent access. This constitutes exploit code.

CVE-2026-20182-portbuster1337/cve-2026-20182.py:1-244CVE-2026-20182-portbuster1337/README.md:1-3

Requirements

  • Network access to the target's vdaemon service on UDP port 12346CVE-2026-20182-portbuster1337/cve-2026-20182.py:196
  • Python 3.7+ with cryptography library and openssl CLICVE-2026-20182-portbuster1337/README.md:111-113

Observed behavior

  • Establishes a DTLS 1.2 connection to the target's vdaemon service on UDP/12346CVE-2026-20182-portbuster1337/cve-2026-20182.py:79-84
  • Sends a CHALLENGE_ACK message with device_type=2 (vHub) to bypass authenticationCVE-2026-20182-portbuster1337/cve-2026-20182.py:44-47CVE-2026-20182-portbuster1337/cve-2026-20182.py:114-116
  • Sends a HELLO message to transition the peer to UP stateCVE-2026-20182-portbuster1337/cve-2026-20182.py:50-51CVE-2026-20182-portbuster1337/cve-2026-20182.py:144-146
  • Injects an SSH public key into /home/vmanage-admin/.ssh/authorized_keys via MSG_VMANAGE_TO_PEERCVE-2026-20182-portbuster1337/cve-2026-20182.py:54-57CVE-2026-20182-portbuster1337/cve-2026-20182.py:162-164
  • Optionally verifies exploitation by establishing a NETCONF session over SSH on port 830CVE-2026-20182-portbuster1337/cve-2026-20182.py:199-211
  • A secondary script attempts to send an encrypted payload that includes a reverse shell commandcve-2026-20182-poc.py:118-128
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Concealed Behavior
  • The script cve-2026-20182-poc.py includes a reverse shell payload (payload withheld) that connects back to the operator's machine. This behavior is not mentioned in the repository's README.md, the script's own argparse help text, or the script's initial warning banner, which only describes it as a 'PoC' for the CVE.cve-2026-20182-poc.py:119-124cve-2026-20182-poc.py:139-148README.md:1-97

Observables

Reverse Shell Command
Payload withheldThis command is embedded in the payload sent to the target by cve-2026-20182-poc.py. It establishes a reverse shell from the target back to the operator's machine, which is a materially different and more invasive action than the disclosed SSH key injection.cve-2026-20182-poc.py:119-124
Listener
Payload withheldThe script cve-2026-20182-poc.py starts a TCP listener on the operator's machine to receive the reverse shell connection, confirming the payload is intended to target the operator's system.cve-2026-20182-poc.py:71-77cve-2026-20182-poc.py:166-168
Review boundaries

What the analysis did not establish

  • Two files (requirements.txt and an unspecified file) are present in the repository but not included in the evidence text.
  • The secondary script (cve-2026-20182-poc.py) uses an encrypted payload format that differs from the documented protocol and may not function correctly against a real target.
  • The evidence does not include any output or logs confirming successful execution of the exploit.
  • Two files (requirements.txt and a second README) were omitted from the text evidence, but their content is unlikely to alter the finding as the primary scripts are fully reviewed.
  • The review does not assess the validity of the exploit against the target or the correctness of the CVE association.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubNxploited/CVE-2026-20182Repository PoCby Nxploited1Exploit5 files

144.2 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 3 exploit framework for CVE-2026-20182 that performs an authentication bypass on Cisco Catalyst SD-WAN Controller/Manager via crafted DTLS handshake messages, injects an SSH public key, and verifies SSH access to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python exploit script (CVE-2026-20182.py), a README.md, and a requirements.txt file. The script implements a proof-of-concept for CVE-2026-20182, a Cisco SD-WAN authentication bypass. It performs DTLS handshakes, sends crafted protocol messages, optionally injects an SSH public key, and verifies SSH access. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload targeting the person running the PoC was observed. The code's behavior is consistent with the stated vulnerability exploitation and assessment purpose.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareCisco Catalyst SD-WAN ControllerCisco Catalyst SD-WAN Manager
Attack typesauthentication_bypassremote_code_execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains code that actively exploits CVE-2026-20182 by sending crafted network messages to bypass authentication, inject an SSH key, and establish remote access. This is confirmed by the README description and the perform_exploit_attempt function which implements the full attack chain.

README.md:57-73CVE-2026-20182.py:1255-1408

Requirements

  • Requires Python 3.9+ with cryptography and rich libraries, and OpenSSL 3.x/4.x shared libraries.requirements.txt:1-6README.md:97-101
  • Requires a target list file with IP addresses or hostnames of vulnerable Cisco SD-WAN controllers.README.md:284-307

Observed behavior

  • Establishes a DTLS connection to the target on UDP port 12346.CVE-2026-20182.py:1085-1135
  • Sends a crafted CHALLENGE_ACK message as a vHub (type 2) to bypass peering authentication.CVE-2026-20182.py:1303-1304
  • Completes a Hello exchange to confirm the bypass.CVE-2026-20182.py:1315-1327
  • Injects an attacker-generated SSH public key via a VMANAGE_TO_PEER message.CVE-2026-20182.py:1337-1338
  • Verifies SSH access as vmanage-admin on TCP port 830 (NETCONF) using the injected key.CVE-2026-20182.py:1364-1377
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Ssh Key Generation And Injection
Payload withheldThis is the core exploit mechanism for CVE-2026-20182, enabling unauthorized SSH access to the target device. It is not a backdoor against the operator.CVE-2026-20182.py:337-338CVE-2026-20182.py:758-777
Ssh Verification
Payload withheldThis verifies the exploit's success against the target, not against the operator's machine.CVE-2026-20182.py:809-895
Output Files
Payload withheldThese are standard output artifacts for an assessment tool. No evidence of exfiltration or hidden data collection.CVE-2026-20182.py:68-74CVE-2026-20182.py:481-571
Author Contact
Payload withheldAuthor contact information is present but does not constitute backdoor behavior.README.md:39
Review boundaries

What the analysis did not establish

  • Evidence includes only selected text files; one non-text media file (Nx.png) and one text file (LICENSE) are omitted.
  • complete_artifact_coverage is false; the repository contains 5 files, but only 3 text files are fully included.
  • One non-text media file (Nx.png, 57281 bytes) was flagged as metadata-only and not analyzed for steganography or hidden payloads.
  • One unclassified file (1505 bytes) was not analyzed.
  • The review is limited to the supplied text evidence; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

1
ProjectDiscoveryCRITICALCisco Catalyst SD-WAN Controller - vHub Authentication BypassCVSS 10

Cisco Catalyst SD-WAN Controller and Manager contain an authentication bypass caused by improper peering authentication mechanism, letting unauthenticated remote attackers obtain administrative privileges, exploit requires sending crafted requests.

Impact

Unauthenticated attackers can gain administrative access and manipulate network configurations, risking full control of the SD-WAN fabric.

Remediation

Update to the latest fixed version as per Cisco advisory.

WeaknessesCWE-287
Authorssfewer-r7, Crypto-Cat, pussycat0x, DhiyaneshDk
Template tagscvecve2026ciscosdwanauth-bypassnetworkcriticalkevvulnvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CPE: cpe:2.3:a:cisco:catalyst_sd-wan_controller:*:*:*:*:*:*:*:*
Shodan: port:12346 product:"Cisco SD-WAN"
FOFA: port="12346" && product="Cisco SD-WAN"
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/ https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/ https://nvd.nist.gov/vuln/detail/CVE-2026-20182

Source: ProjectDiscovery

Research & analysis

1
Technical researchRapid7 Labs (Jonah Burgess, Stephen Fewer)Source: EIP research review

CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller (FIXED)

Rapid7 Labs (Jonah Burgess, Stephen Fewer) discovered and analyzed CVE-2026-20182, an authentication bypass in Cisco Catalyst SD-WAN Controller's vdaemon service (DTLS over UDP 12346). The vulnerability exists in vbond_proc_challenge_ack(): the function implements device-type-specific certificate verification for vSmart (type 3), vManage (type 5), and vEdge (type 1), but has no code path for device_type==2 (vHub). A peer claiming to be a vHub in the CHALLENGE_ACK message skips all verification and falls through to peer->authenticated=true. The 12-byte vdaemon message header encodes device_type in the upper nibble of byte 1. Post-authentication, an attacker can inject an SSH public key into the vmanage-admin user's authorized_keys file via MSG_VMANAGE_TO_PEER (type 14) and access NETCONF over SSH on TCP port 830. Cisco Talos confirmed active in-the-wild exploitation by UAT-8616 as of May 14, 2026. Cisco released fixed software releases; no workarounds exist. The vulnerability is distinct from CVE-2026-20127 but affects the same service and was discovered during investigation of that prior vulnerability.

Root causeTechnical detailExploitation
https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed
Research notes
Supporting sources
ReferenceOngoing exploitation of Cisco Catalyst SD-WAN vulnerabilities
ReferenceCisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

References

3