New Cisco SD-WAN Zero-Day Grants Admin Entry

Community Firewalls, Community Entry Management
,
Safety Operations

Damaged vdaemon Peering Authentication Permits Unauthenticated Admin Entry

Tiffany Wang •
Might 15, 2026    

A maximum-severity vulnerability in Cisco Catalyst SD-WAN Controller is being actively exploited, giving attackers administrative privileges with out authentication.

See Additionally: Multi-Cloud Safety Drives Firewall Evolution

The authentication bypass vulnerability, assigned CVE-2026-20182 with a CVSS rating of 10, stems from a damaged peering authentication mechanism within the vdaemon service. It permits attackers to control SD-WAN’s community configuration.

The U.S. Cybersecurity and Infrastructure Company added the flaw Thursday to its catalog of recognized exploited vulnerabilities and gave federal businesses till Sunday to repair it.

Cisco attributes the exploit to a menace actor it tracks as UAT-8616, which had beforehand breached the identical service in SD-WAN in hacking incidents courting again to 2023. Whereas the brand new vulnerability abuses a unique subject within the networking service, the 2 exploits adopted the identical steps of execution.

“UAT-8616 tried so as to add SSH keys, modify NETCONF configurations and escalate to root privileges,” Cisco’s menace intelligence crew Talos stated.

Cisco stated UAT-8616 targets essential infrastructure sectors, and its infrastructure overlaps with operational relay field networks monitored by Cisco Talos. ORB networks are collections of servers and hacked internet-connected units continuously linked to Chinese language espionage.

Cybersecurity agency Rapid7 found the most recent exploit whereas researching the earlier SD-WAN vulnerability. The flaw exposes a number of ports together with UDP 12346 – the control-plane peering port utilized by vdaemon as a trusted communications channel between controllers and edge units.

UDP port 12346 “carries Overlay Administration Protocol (OMP) messages together with route commercials, Transport Places (TLOC) tables and peer state – everything of the SD-WAN overlay routing cloth. Compromising this service means compromising the community,” Rapid7 researchers Jonah Burgess and Stephen Fewer stated.

Cisco stated it discovered restricted exploitation of the vulnerability this month, recommending its clients to improve to mounted software program releases.

The brand new spherical of SD-WAN exploitation comes as Cisco introduced a 4,000-person layoff this week and informed buyers it has integrated Anthropic’s Mythos into its manufacturing system and patch growth.

Different vulnerabilities in SD-WAN, CVE-2026-20133, CVE-2026-20128 and CVE-2026-20122, are additionally being exploited since March following public proof-of-concept code.

“A number of vulnerabilities in Cisco Catalyst SD-WAN Supervisor, previously SD-WAN vManage, may permit an attacker to entry an affected system, elevate privileges to root, acquire entry to delicate info and overwrite arbitrary information,” Cisco stated.