Network hardware giant Cisco has released a patch for a critical-severity vulnerability in its Cisco Catalyst SD-WAN Controller devices.
CVE-2026-20182 – first spotted by Rapid7 researchers in March and addressed by Cisco on 14 May – is a vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller that could allow a remote attacker to bypass authentication and gain administrative privileges.
“This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system,” Cisco said in a 14 May security advisory.
“A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.”
The vulnerability impacts all configurations of Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager, regardless of deployment type.
While there is no workaround for this vulnerability, Cisco has released a series of software updates; however, some releases that are at end-of-life may require upgrades to a supported release.
Rapid7 has published a proof-of-concept exploitation of the vulnerability, which can be found here.
“Cisco values the role of the security research community in helping maintain a secure ecosystem, and we appreciate the collaboration with Rapid7. We have released a software update to remediate the identified vulnerability,” Cisco said.
“We remain committed to transparent communication and to providing our customers with the robust security and resilience they expect.”
The vulnerability is already being actively exploited, and has been added to the United States Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities Catalog as of 14 May. According to Cisco, however, the exploitation is so far “limited”.
“In May 2026, the Cisco Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability,” Cisco said.
“Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
David Hollingworth
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.