criticalCISA KEVCVE-2026-20182

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.

Browse Network Security security risks

ProductCatalyst SD-WAN

CVSS10.0

EPSS0.87693

UpdatedJuly 9, 2026

Quick answer

Cisco Catalyst SD-WAN should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.

Who is affected

Affected versions

20.12.7

Fixed versions

Apply the latest vendor-supported patched version.

How to fix it

CVE-2026-20182 is an authentication bypass in Cisco Catalyst SD-WAN Controller and Manager that can allow unauthenticated remote administrative access. Cisco states that software updates are available and that there are no workarounds. Preserve indicators with admin-tech collection before upgrading where possible, then upgrade affected control components and validate SD-WAN peering, auth logs, and configuration integrity.

Identify all Cisco Catalyst SD-WAN Controller, Manager, and related control components in every deployment type.
Before upgrading, collect request admin-tech output from control components to preserve possible indicators of compromise.
Upgrade affected Cisco Catalyst SD-WAN software to a fixed release listed in the Cisco advisory.
Limit management and control-plane exposure to trusted networks and remove unnecessary internet exposure.
Review auth.log and control connection logs for unknown vmanage-admin access, unauthorized peers, unexpected system IPs, or abnormal peering events.
Validate SD-WAN configuration, policies, templates, device inventory, and certificates for unauthorized changes.
Open a Cisco TAC case with the CVE ID if compromise indicators are found or validation is uncertain.

Scan now. Google sign-in is only needed to unlock fix guidance.

Verify the fix

Confirm each SD-WAN control component reports a Cisco fixed software release.
Verify all control connections and peering events map to authorized devices and expected maintenance windows.
Confirm no unknown public IPs, system IPs, or vmanage-admin logins appear in auth logs.
Validate configuration backups against the current running configuration for unauthorized changes.
Run a Fixnx scan and exposure review for public management surfaces after upgrades.

Related categories

Network Security Authentication Bypass

Related security risks

More published guidance from the same primary category.

critical

Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

Updated July 9, 2026

critical

Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

Updated July 9, 2026

critical

Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

Updated July 9, 2026

Trusted references

CISA KEV entryCISA KEV CISA KEV entryCISA KEV CISA KEV entryCISA KEV Source advisoryCISA KEV Source advisoryCISA KEV

FAQ

What is affected by CVE-2026-20182?

Cisco Catalyst SD-WAN should be checked against the vendor advisory and trusted references linked on this page.

What should I fix first?

Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.

How do I confirm the fix worked?

Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.

How are Fixnx security risk categories chosen?

Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.