Cisco Catalyst SD-WAN Controller Critical Authentication Bypass Flaw Exploited in Zero-Day Attacks – May 2026

Lifecycle changed

monitoring → closed

Event Closed

auto_closed_monitoring_timeout

Status changed to monitoring

Auto-transitioned: no updates for 6 hours

active → monitoring

Status changed to active

remediation: existing active criteria met

developing → active

Impact changed

high → medium

Status changed to developing

Auto-promoted: multiple sources

The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered all federal agencies to apply a patch for an actively exploited vulnerability in Cisco SD-WAN systems by Sunday. The flaw allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges on affected systems. Cisco released a patch on Thursday alongside an advisory disclosing the severity of the vulnerability. The directive signals active exploitation in the wild, raising concerns for critical infrastructure and enterprise network security.

Source: The Record (Cyber) (Trade Media) · View source

Initial Detection

Cisco has issued a warning regarding a critical authentication bypass vulnerability in its Catalyst SD-WAN Controller, tracked as CVE-2026-20182, which has been actively exploited in zero-day attacks. The flaw enables attackers to gain administrative privileges on compromised devices. The exploitation of SD-WAN infrastructure poses significant risks to enterprise and critical infrastructure networks globally, as SD-WAN controllers are widely deployed across corporate and government environments.

Cisco is warning that a critical Catalyst SD-WAN Controller authentication bypass flaw, tracked as CVE-2026-20182, was actively exploited in zero-day attacks that allowed attackers to gain administrative privileges on compromised devices.

Source: BleepingComputer (Trade Media) · View source