Authentication bypass in Cisco Catalyst SD-WAN (CVE-2026-20182) — admin access without authentication, a perfect CVSS 10.0

CVE-2026-20182 is an authentication-bypass vulnerability (CWE-287: improper authentication) in Cisco Catalyst SD-WAN Controller and Manager. It was added to CISA's KEV catalog on May 14, 2026.

Per NVD, an unauthenticated remote attacker can bypass authentication and obtain administrative privileges on an affected system. It is a near-worst-case flaw: network-reachable, low attack complexity, no privileges required, with maximum impact to confidentiality, integrity, and availability and impact spilling over to other components.

An SD-WAN Controller/Manager is the "control center" that centrally manages an enterprise's wide-area network. Seizing it without authentication could let an attacker alter network configuration or manipulate traffic — operations that ripple across the whole organization. Given the severity, CISA went beyond a standard KEV listing and issued Emergency Directive 26-03, requiring assessment of exposure, risk reduction, and adherence to hunt-and-hardening guidance.

Key response: follow CISA's Emergency Directive 26-03 and its hunt-and-hardening guidance for SD-WAN devices (URLs in the KEV Notes) to assess exposure and mitigate. For cloud use, follow BOD 22-01, and discontinue use if mitigations are unavailable. The federal civilian remediation deadline was a short May 17, 2026.