Cisco Patches Sixth SD-WAN Zero-Day of 2026 as CISA Adds CVE-2026-20182 to KEV With Three-Day Federal Deadline
A second authentication bypass in the same vdaemon stack as February's CVE-2026-20127 carries a CVSS 10.0 and is being exploited by the same UAT-8616 cluster, Cisco and Talos disclosed on May 14.
Overview
Cisco on May 14 disclosed a second critical authentication bypass in its Catalyst SD-WAN Controller and Manager products, tracked as CVE-2026-20182 and carrying the maximum CVSS v3.1 base score of 10.0, according to the NIST National Vulnerability Database. The same day, the U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog and gave Federal Civilian Executive Branch agencies until May 17 to remediate, The Hacker News reported. SecurityWeek calls it “the sixth SD-WAN flaw whose exploitation came to light in 2026.”
The new bug sits in the same vdaemon service over DTLS on UDP port 12346 that was vulnerable to CVE-2026-20127 earlier this year, Help Net Security noted. Rapid7, however, is explicit that the new vulnerability “is not a patch bypass of CVE-2026-20127” but “a different issue located in a similar part of the ‘vdaemon’ networking stack.”
What We Know
The vulnerability is classified under CWE-287, Improper Authentication, per Rapid7. According to CISA’s description as reproduced by The Hacker News, “Cisco Catalyst SD-WAN Controller and Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.” The NVD entry carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H and was published on May 14, 2026.
The technical root cause, per Rapid7’s analysis, is a missing verification path for one device type in the peering logic: “There is no ‘if’ block matching a device type of 2 (vHub); the vHub device type simply has no verification code.” Once this gap is reached, Rapid7 writes, “A remote unauthenticated attacker can leverage CVE-2026-20182 to become an authenticated peer,” and afterwards “a remote unauthenticated attacker can login to the NETCONF service” to manipulate SD-WAN fabric configuration.
Fixed software trains, per Rapid7, include 20.9.9.1; 20.12.5.4, 20.12.6.2, and 20.12.7.1 on the 20.12 branch; 20.15.4.4 and 20.15.5.2 on the 20.15 branch; 20.18.2.2 on the 20.18 branch; and 26.1.1.1 on the 26.1 branch. Releases earlier than 20.9 through 26.1.1 are affected.
Active Exploitation and Attribution
SecurityWeek reports that “Cisco said it became aware of active exploitation in May, and the company’s Talos threat intelligence and research group revealed that CVE-2026-20182 appears to have been exploited in limited attacks by a threat actor it tracks as UAT-8616.” The outlet characterizes UAT-8616 as “a highly sophisticated group” whose “motivation and potential connections to a specific country or known group have not been revealed.”
UAT-8616 is the same cluster previously tied to exploitation of CVE-2026-20127. The Hacker News summarizes Talos’s findings on post-compromise activity: “UAT-8616 attempted to add SSH keys, modify NETCONF configurations, and escalate to root privileges.” The outlet adds that the group’s infrastructure overlaps with Operational Relay Box (ORB) networks, a category of compromised devices that state-aligned operators often use to obscure attack origins.
Help Net Security similarly notes that “Cisco’s threat analysts tied the exploitation of both vulnerabilities to a group they dubbed ‘UAT-8616.’”
CISA’s Three-Day Deadline
SecurityWeek reports that “CISA has added CVE-2026-20182 to its KEV catalog, instructing federal agencies to address it within three days.” The CISA alert posted on May 14 carries a Federal Civilian Executive Branch remediation deadline of May 17, 2026, per The Hacker News. KEV listings carry binding remediation timelines for federal civilian agencies and serve as a widely watched signal for private-sector defenders.
The new entry follows a sequence of SD-WAN zero-day disclosures Cisco has issued since February. SecurityWeek’s tally places CVE-2026-20182 as the sixth such flaw whose exploitation surfaced in 2026, alongside CVE-2026-20127, CVE-2026-20128, CVE-2026-20122, CVE-2026-20133, and the older CVE-2022-20775 “flagged as exploited in the wild this year.”
What We Don’t Know
Neither Cisco nor Talos has publicly disclosed UAT-8616’s geographic origin or sponsor, the scope of victim organizations, or the timeline on which exploitation of CVE-2026-20182 began. SecurityWeek’s description is that exploitation so far appears “limited” — a characterization typically used for targeted intrusion campaigns rather than mass scanning. The number of compromised SD-WAN Controllers and Managers has not been quantified in the public record.
It is also not clear from the public disclosures why a vulnerability functionally equivalent to CVE-2026-20127, in the same daemon and on the same UDP port, was missed during the remediation of the earlier flaw, although Rapid7’s analysis frames the new bug as a distinct logic gap in the vHub device-type path rather than a regression of the previous fix.