Cisco Fixes Sixth SD-WAN Vulnerability Exploited in 2026

Post Views: 7

Cisco Patches Sixth SD-WAN Zero-Day Exploited This Year

Cisco recently released patches for a critical SD-WAN zero-day vulnerability, tracked as CVE-2026-20182, after the company’s Talos threat intelligence and research team detected active exploitation. This marks the sixth SD-WAN flaw to be exploited in 2026, following a string of similar vulnerabilities.

The Newly Patched Vulnerability

A remote attacker can gain admin privileges on the targeted system via specially crafted packets, leveraging a weakness in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager.

According to Talos researchers, the exploit appears to have been carried out by a sophisticated threat actor known as UAT-8616, which had previously exploited a different SD-WAN vulnerability, CVE-2026-20127.

The researchers noted that the two vulnerabilities affect the same component, indicating that the weaknesses are related.

Rapidly Addressing the Vulnerability

Rapid7, a cybersecurity firm, reported CVE-2026-20182 to Cisco and provided technical details, which the vendor subsequently used to develop patches.
The National Institute of Standards and Technology (NIST) has added the vulnerability to its Known Exploits and Vulnerabilities (KEV) catalog, requiring federal agencies to address it within three days.

Ongoing Threats and Recommendations

An ongoing analysis of 10 activity clusters observed exploiting SD-WAN vulnerabilities to deliver various types of malware and hacking tools, including cryptocurrency miners, credential stealers, backdoors, webshells, and more.
Organizations relying on Cisco SD-WAN technology should prioritize applying the latest patches to their systems to mitigate the risks associated with CVE-2026-20182.
Administrators should review their network configurations to ensure they comply with best practices and consider implementing additional security measures to prevent future exploits.