Cisco SD-WAN Controller Authentication Bypass Active Exploit (CVE-2026-20182) | MSSP Advisory

Cisco patched CVE-2026-20182, an authentication bypass vulnerability in Catalyst SD-WAN Controller and SD-WAN Manager that allows attackers to completely bypass authentication mechanisms. A highly sophisticated threat actor actively exploited this zero-day in the wild before the patch release. The flaw affects both on-premises and cloud deployments of Cisco's SD-WAN infrastructure.

Your RMM and remote access tools likely traverse client SD-WAN infrastructure, meaning compromised controllers could intercept your management traffic or redirect it to attacker-controlled endpoints. Every client running Cisco SD-WAN becomes a potential breach source that reflects back on your security posture, and unpatched controllers give attackers network-level access to client environments you are contractually obligated to protect.