CVE-2026-20182

Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN Controller (affected versions not specified) Cisco Catalyst SD-WAN Manager (affected versions not specified) Cisco Catalyst SD-WAN Validator (affected versions not specified)

Description A flaw in the peering authentication mechanism of the control connection handshaking allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges. The issue exists because the system fails to properly validate incoming certificates and tokens when specific header options are altered, specifically within the vdaemon service. An attacker can mimic a legitimate network controller by establishing a DTLS connection with a self-signed certificate and sending crafted requests to the peering authentication endpoint.

Successful exploitation allows the attacker to log in as a high-privileged internal non-root user, granting access to NETCONF. This enables the manipulation of the entire SD-WAN fabric, including global routing tables, BGP routes, firewall rules, and VPN topology. The vulnerability has been actively exploited in the wild by threat actors, including a state-sponsored group designated as UAT-8616, who have used it to inject SSH keys, modify configurations, and escalate privileges to root.

Recommendations Update Cisco Catalyst SD-WAN Controller, Manager, and Validator to version 20.12.6.2 or newer. Restrict management-plane access to known administrator IP ranges via Access Control Lists (ACLs) to ensure the peering authentication endpoint is not reachable from arbitrary network sources. Restrict all inbound external access to NETCONF endpoints. Audit peering logs for unauthorized attachment sequences and inspect user databases for unauthorized secondary administrative accounts. Verify configuration hashes of global routing and security policy tables against known-good backups to detect malicious traffic-mirroring paths.