VulnerabilityBleeping Computer
10.0 — CRITICAL
Cisco warns of new critical SD-WAN flaw exploited in zero-day attacks
Cisco is warning that a critical Catalyst SD-WAN Controller authentication bypass flaw, tracked as CVE-2026-20182, was actively exploited in zero-day attacks that allowed attackers to gain administrative privileges on compromised devices. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A critical authentication bypass flaw in Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager allowed attackers to gain administrative privileges on compromised devices, with threat actors exploiting the vulnerability in zero-day attacks since May.
⚙️Technical Details
Affected Systems
Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager
Attack Vectors
NETWORK
💥Impact Assessment
Severity: CRITICAL
Who Is at Risk
Organizations with Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager deployments, particularly those in critical infrastructure sectors.
🛡️Recommended Actions
1Restrict access to SD-WAN management and control-plane interfaces to trusted internal networks or to authorized IP addresses only.
2Review authentication logs for suspicious login activity, specifically for entries showing 'Accepted publickey for vmanage-admin' from unknown IP addresses.
3Upgrade to a fixed software release, as this is the only way to fully remediate CVE-2026-20182.
📦Affected Products
Cisco Catalyst Sd-Wan ManagerCisco Sd-Wan Vsmart ControllerCisco Catalyst SD-WAN ControllerCisco Catalyst SD-WAN Manager
🔐NVD Verified DataVERIFIED
CVE-2026-20182 ↗CVSS 10 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HWeaknesses
CWE-287
CVE-2026-20127 ↗CVSS 10 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HWeaknesses
CWE-287
Affected Products (CPE)
Cisco Catalyst Sd-Wan ManagerCisco Sd-Wan Vsmart Controller
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.