CVE-2026-20182

Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN Controller (affected versions not specified) Cisco Catalyst SD-WAN Manager (affected versions not specified) Cisco Catalyst SD-WAN Validator (affected versions not specified)

Description A flaw in the peering authentication mechanism of the control connection handshaking allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges. The issue exists because the system fails to properly validate incoming certificates and tokens during inter-controller session setups, specifically within the vdaemon service. By sending crafted requests—such as a DTLS connection with a self-signed certificate—an attacker can mimic a trusted peer and be granted a high-privileged internal user account. This access enables the use of NETCONF to manipulate global routing tables, inject malicious routing policies, and modify network configurations across the entire SD-WAN fabric. The issue has been actively exploited in the wild by sophisticated threat actors, including the group UAT-8616, to deploy SSH keys, install web shells, and run cryptocurrency miners.

Recommendations Update Cisco Catalyst SD-WAN Controller, Manager, and Validator to version 20.12.6.2 or newer. Restrict management-plane access to known administrative IP ranges via Access Control Lists (ACLs) to ensure the peering authentication endpoint is not reachable from arbitrary network sources. Restrict all inbound external access to NETCONF endpoints. Audit peering logs for unauthorized attachment sequences and inspect user databases for unauthorized secondary administrative accounts. Perform a diff analysis of global routing and security policy tables against known-good backup baselines to detect malicious traffic-mirroring paths.