DMZ//THREAT INTEL
FEED ACTIVELAST SYNC: 06:03:37ZSOURCES: 14CRITICAL: 15
⚠ ACTIVE ALERTS
SYLVANITE CRITICAL — SYLVANITE is a newly named Dragos-tracked threat group identified as a dedicated… /// @MsftSecIntel CRITICAL — We are tracking TeamPCP (UNC6780) activity following the GitHub internal repository… /// @GossiTheDog CRITICAL — The GitHub / TeamPCP breach is now being monetized on BreachForums. Listing is up — $95k… /// @struppigel CRITICAL — SUPPLY CHAIN ALERT: Laravel-Lang PHP packages backdoored May 22-23 via hijacked GitHub… /// @MalwareHunterTeam CRITICAL — Seeing fresh DebugElevator stealer log batches already appearing for sale on Exploit.in —…
15Critical Threats
8Active CVEs
0IOCs Tracked
0New Advisories
INTEL FEED/CVE TRACKER/CVE-2026-20182
TLP:WHITEVULNERABILITY BRIEF // CVE-2026-20182PUBLISHED: 2026-05-14
■ CRITICALCVE-2026-20182★ CISA KEV LISTED

Cisco Catalyst SD-WAN Controller Authentication Bypass (Zero-Day)

VENDOR: Cisco//PRODUCT: Catalyst SD-WAN Controller (vSmart) / SD-WAN Manager (vManage)
10
CRITICAL
CVSS 3.1
✓
PATCH STATUS
PATCH AVAILABLE
◐
EXPLOIT STATUS
LIMITED EXPLOITATION

VULNERABILITY OVERVIEW

A vulnerability in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller and Manager allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges by sending crafted requests to the 'vdaemon' service over DTLS (UDP port 12346). Successful exploitation allows the attacker to inject an SSH public key into the vmanage-admin account, access NETCONF (TCP/830), and arbitrarily manipulate SD-WAN fabric network configurations. Cisco Talos attributes active exploitation to nation-state-linked threat actor UAT-8616; Rapid7 discovered the flaw and published a working Metasploit module. CISA issued Emergency Directive 26-03 mandating federal remediation by May 17, 2026.

CVSS BREAKDOWN

↗
Attack Vector
NETWORK
△
Attack Complexity
LOW
⚷
Privs Required
NONE
◈
User Interaction
NONE
⊕
Scope / Impact
CHANGED
C:H · I:H · A:H
AFFECTED VERSIONSCatalyst SD-WAN Controller and Manager all versions prior to fixed releases (20.9.x, 20.12.x, 20.15.x, 20.16.x)

CITATIONS

  • → Cisco Security Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
  • → Rapid7 Blog: https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/
  • → Cisco Talos: https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
  • → CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • → The Hacker News: https://thehackernews.com/2026/05/cisco-catalyst-sd-wan-controller-auth.html
SHARE BRIEF:✕ Post on Xin Share on LinkedIn