{"schema":"threatline.record/2","record":{"id":"CVE-2026-20182","aliases":[],"summary":"Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability","details":"Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.","categories":["Network & edge"],"product":"Catalyst SD-WAN","vendor":"Cisco","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-20182","source_modified_at":"2026-06-16T17:57:59.048Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Cisco Catalyst SD-WAN Controller","vendor":"Cisco","versions":[{"version":"20.6.4","status":"affected"},{"version":"20.9.2","status":"affected"},{"version":"20.3.6","status":"affected"},{"version":"20.7.2","status":"affected"},{"version":"20.7.1","status":"affected"},{"version":"20.5.1","status":"affected"},{"version":"20.6.2","status":"affected"},{"version":"19.3.0","status":"affected"},{"version":"20.6.1","status":"affected"},{"version":"17.2.4","status":"affected"},{"version":"18.2.0","status":"affected"},{"version":"18.4.6","status":"affected"},{"version":"19.1.0","status":"affected"},{"version":"19.2.4","status":"affected"},{"version":"19.2.929","status":"affected"},{"version":"18.3.8","status":"affected"},{"version":"18.4.303","status":"affected"},{"version":"18.3.7","status":"affected"},{"version":"18.4.1","status":"affected"},{"version":"19.2.097","status":"affected"},{"version":"19.2.0","status":"affected"},{"version":"19.2.099","status":"affected"},{"version":"18.3.6","status":"affected"},{"version":"20.4.2","status":"affected"},{"version":"19.0.0","status":"affected"},{"version":"20.9.1","status":"affected"},{"version":"20.3.5","status":"affected"},{"version":"20.3.1","status":"affected"},{"version":"18.3.5","status":"affected"},{"version":"20.6.3","status":"affected"}],"defaultStatus":"unknown"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-20182","source_modified_at":"2026-06-16T17:57:59.048Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Cisco Catalyst SD-WAN Manager","vendor":"Cisco","versions":[{"version":"20.1.12","status":"affected"},{"version":"19.2.1","status":"affected"},{"version":"18.4.4","status":"affected"},{"version":"18.4.5","status":"affected"},{"version":"20.1.1.1","status":"affected"},{"version":"20.1.1","status":"affected"},{"version":"19.2.099","status":"affected"},{"version":"18.3.6","status":"affected"},{"version":"18.3.7","status":"affected"},{"version":"19.2.0","status":"affected"},{"version":"19.1.0","status":"affected"},{"version":"18.4.303","status":"affected"},{"version":"19.2.098","status":"affected"},{"version":"18.3.6.1","status":"affected"},{"version":"18.2.0","status":"affected"},{"version":"17.2.8","status":"affected"},{"version":"18.3.3.1","status":"affected"},{"version":"18.4.0","status":"affected"},{"version":"18.3.1","status":"affected"},{"version":"17.2.6","status":"affected"},{"version":"17.2.9","status":"affected"},{"version":"17.2.5","status":"affected"},{"version":"18.4.0.1","status":"affected"},{"version":"18.3.3","status":"affected"},{"version":"18.3.0","status":"affected"},{"version":"19.2.3","status":"affected"},{"version":"18.4.501_ES","status":"affected"},{"version":"20.1.2","status":"affected"},{"version":"19.2.929","status":"affected"},{"version":"19.2.31","status":"affected"}],"defaultStatus":"unknown"}],"fixed_versions":[],"cvss":10,"severity":"Critical","kev":{"listed":true,"date_added":"2026-05-14","due_date":"2026-05-17","required_action":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.91817,"percentile":0.99818,"score_date":"2026-10-23"},"published_at":"2026-05-14T16:08:25.566Z","modified_at":"2026-06-16T17:57:59.048Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-20182","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-06-16T17:57:59.048Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-05-07"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20182","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Metasploit","EPSS"],"references":[{"url":"https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems","source":"CISA KEV"},{"source":"CVE List","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20182","source":"CISA KEV"},{"source":"CVE List","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"total","assessed_at":"2026-05-14T00:00:00+00:00"},"exploits":[{"source":"Metasploit","kind":"Auxiliary module","name":"Cisco Catalyst SD-WAN Controller vHub Authentication Bypass","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb","date":"2026-05-07","added":"2026-06-30","check":true}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"vendor and product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-06-16T17:57:59.048Z","content_hash":"4719522b52253832ed4915fcd5e7c359a507675530df2383deb440f6acce0b71"}}