Authentication bypass in Cisco Catalyst SD-WAN (CVE-2026-20182) — admin access without authentication, a perfect CVSS 10.0

1Authentication bypass in Catalyst SD-WAN

CVE-2026-20182 is an authentication-bypass vulnerability (CWE-287: improper authentication) in Cisco Catalyst SD-WAN Controller and Manager. It was added to CISA's KEV catalog on May 14, 2026.

2The attack NVD describes

Per NVD, an unauthenticated remote attacker can bypass authentication and obtain administrative privileges on an affected system. It is a near-worst-case flaw: network-reachable, low attack complexity, no privileges required, with maximum impact to confidentiality, integrity, and availability and impact spilling over to other components.

3A position at the center of the WAN

An SD-WAN Controller/Manager is the "control center" that centrally manages an enterprise's wide-area network. Seizing it without authentication could let an attacker alter network configuration or manipulate traffic — operations that ripple across the whole organization.

Given the severity, CISA went beyond a standard KEV listing and issued Emergency Directive 26-03, requiring assessment of exposure, risk reduction, and adherence to hunt-and-hardening guidance.

4Whether impact stays inside the device

CVSS carries an axis, Scope, for whether impact stays within the vulnerable component or spreads beyond it. This record is on the spreading side.

An SD-WAN Controller and Manager are the control centre managing an enterprise's wide-area network. Taken without authentication, an attacker can alter the network configuration or manipulate traffic in ways that reach the whole organisation. Given the severity, CISA issued an emergency directive alongside the KEV listing, asking for assessment of exposure, risk reduction and hunting for indicators of compromise.