Cisco Catalyst SD-WAN Controller Flaw Under Active Exploitation for Admin Access

Cisco has disclosed a critical vulnerability in its Catalyst SD-WAN platform that is already being exploited in the wild, allowing attackers to gain administrative control over enterprise networks without authentication.

Critical SD-WAN flaw under attack

The vulnerability, tracked as CVE-2026-20182, carries a maximum CVSS score of 10.0 and affects Cisco Catalyst SD-WAN Controller (vSmart) and SD-WAN Manager (vManage).

According to Cisco’s advisory released on May 14, 2026, the flaw enables a remote, unauthenticated attacker to bypass authentication and gain high-privileged access to affected systems.

Cisco’s Product Security Incident Response Team (PSIRT) confirmed limited active exploitation, making this a high-priority threat for organizations running SD-WAN environments.

The issue stems from improper authentication (CWE-287) in the control plane’s peering mechanism. Attackers can send specially crafted requests to impersonate trusted devices and establish unauthorized connections.

Technical analysis from Rapid7 reveals that the vulnerability lies in the “vdaemon” service, which handles DTLS-based control-plane communications over UDP port 12346. This service authenticates devices that participate in the SD-WAN fabric.

During the authentication handshake process, the system validates peers based on device type. However, a logic flaw allows attackers to declare themselves as a “vHub” device type, which bypasses all certificate verification checks.

As a result:

• The system marks the attacker as authenticated.
• The malicious peer transitions to an active (“UP”) state.
• Full control-plane communication becomes accessible.

Once authenticated, attackers can exploit a secondary feature to inject their own SSH public key into the vmanage-admin account. This creates persistent access without needing credentials.

For example, an attacker can:

• Establish a fake DTLS session.
• Send a crafted CHALLENGE_ACK message.
• Inject an SSH key into the authorized_keys file.
• Log in via NETCONF (TCP port 830) as a privileged user.
• Execute arbitrary configuration commands across the SD-WAN fabric.

This effectively gives attackers the ability to manipulate routing, policies, and network segmentation across the entire infrastructure.

The Cisco Catalyst SD-WAN Controller acts as the central control plane, managing routing and policy decisions across distributed environments. A compromise at this level can have widespread consequences.

Successful exploitation could allow attackers to:

• Modify network configurations across all connected sites.
• Intercept or reroute sensitive traffic.
• Establish persistent backdoor access.
• Disrupt enterprise connectivity or operations.

Because SD-WAN deployments often span cloud, on-premises, and government environments, the attack surface is broad. Cisco confirmed that all deployment types are affected, including Cloud, Cloud-Pro, and FedRAMP environments.

Indicators of compromise

Cisco has provided guidance to help detect potential compromise. One key indicator involves suspicious SSH log entries.

Security teams should monitor the auth.log file located at /var/log/auth.log for entries such as:

• “Accepted publickey for vmanage-admin” from unknown IP addresses.

These IPs should be cross-checked against known system IPs configured in the SD-WAN Manager interface.

Additional signs include:

• Unexpected control-plane peering events.
• Connections from unrecognized public IP addresses.
• Irregular timestamps outside maintenance windows.
• Suspicious device types or mismatched system IPs.

Administrators are also advised to inspect control connections using commands such as “show control connections detail” and to look for anomalies, such as missing challenge acknowledgments.

Affected versions and patching

The vulnerability impacts all Cisco Catalyst SD-WAN Controller and Manager deployments regardless of configuration. There are no workarounds available.

Cisco has released fixed software versions and strongly urges immediate upgrades. Organizations using older or unsupported releases are particularly at risk and should migrate to supported versions.

Before applying updates, Cisco recommends collecting forensic data using the “request admin-tech” command to preserve evidence of potential compromise.

Organizations should take the following actions immediately:

• Upgrade to the latest fixed SD-WAN software.
• Audit authentication and control-plane logs.
• Restrict internet exposure of SD-WAN controllers.
• Validate all control-plane peer connections.
• Engage Cisco TAC if a compromise is suspected.

Rapid7 researchers Stephen Fewer and Jonah Burgess, who discovered the flaw, noted that the vulnerability is distinct from a previously exploited Cisco SD-WAN issue disclosed earlier in 2026, but affects a similar component.

With active exploitation already observed and no available workaround, this vulnerability poses a critical risk to enterprise networks that rely on Cisco SD-WAN infrastructure. Immediate patching and thorough compromise assessment are essential to prevent full network takeover.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.