CISA Orders Patch for Critical Cisco SD-WAN Flaw by 2026

The U.S. Cybersecurity and Infrastructure Security Agency ordered federal civilian executive branch agencies on Thursday to patch a critical vulnerability in Cisco Catalyst SD-WAN Controller and Manager software by May 17, 2026, after confirming active exploitation of the flaw.

Tracked as CVE-2026-20182, the vulnerability carries a maximum CVSS severity score of 10.0 and allows an unauthenticated remote attacker to bypass authentication controls by sending crafted requests. Successful exploitation grants access to a high-privileged, non-root internal account, enabling manipulation of network configurations across the entire SD-WAN fabric via the NETCONF protocol. Cisco released patches for affected systems on May 14, 2026, following its detection of real-world attacks that month.

The flaw, discovered by Rapid7 researchers while investigating a prior vulnerability, affects the peering authentication mechanism in the software, which failed to properly validate incoming connections. Douglas McKee, director of vulnerability intelligence at Rapid7, described it as functioning like a "master key," allowing an attacker to impersonate a trusted network router and gain administrative access.