CVE-2026-20182

Risk summary

Senserva AI Opinion for CVE-2026-20182

This is a maximum severity (CVSS 10.0) authentication bypass in Cisco Catalyst SD-WAN Controller and Manager that hands an unauthenticated remote attacker full administrative control of the systems that orchestrate your entire SD-WAN fabric. CISA confirmed active exploitation and added it to KEV on 2026-05-14, and with a 90% EPSS score the odds of attempted exploitation are very high. Because the controller manages device configs and routing policy across sites, a compromise here can cascade to every edge device it governs.

Do this: Identify all Catalyst SD-WAN Controller and Manager instances, apply Cisco's fixed release now, and restrict management plane access to trusted networks until patched.

AI-generated from public data, 2026-07-25. Verify against the vendor advisory before acting.

Senserva AI Opinion and rich prompt for CVE-2026-20182

Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.

Full tracking and change history for CVE-2026-20182

Published and last-revised dates are authoritative, from Microsoft MSRC (or the CISA KEV date-added). Senserva additionally records day-to-day changes from 2026-07-07, refreshed several times a day; the change count reflects that forward-only tracking.

CISA required action

Federal (BOD 22-01) remediation due date: 2026-05-17 (past due).

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Official fix for CVE-2026-20182

The authoritative fix and affected-version list are published by the vendor. Find the Catalyst SD-WAN advisory on Cisco Security Advisories (PSIRT).

Common questions about CVE-2026-20182

Is CVE-2026-20182 actively exploited?

Yes. CVE-2026-20182 was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-05-14, which means exploitation in the wild has been confirmed, not predicted. Its EPSS 30-day exploitation probability is 90%.

What is the CISA deadline and required action for CVE-2026-20182?

CISA set the federal (BOD 22-01) remediation due date at 2026-05-17, which has passed; treat any unremediated system as overdue. The verbatim required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

What fixes CVE-2026-20182?

The authoritative fix is in the vendor advisory: see Cisco Security Advisories (PSIRT) for the patched Catalyst SD-WAN versions and any workarounds. KEV listing makes this a fix-first item: patch it ahead of higher-CVSS issues nobody is exploiting.

Can I ask my own AI about CVE-2026-20182?

Yes. This page includes a free, ready-to-paste AI prompt containing CVE-2026-20182's key facts: severity, CVSS, EPSS, the KEV date, the CISA due date, and the required action. Copy it into Claude, ChatGPT, or Copilot; the data is refreshed twice a day (5 AM and 3 PM US Central).

More exploited Cisco CVEs

The newest Cisco entries on the CISA KEV catalog:

All Cisco exploited CVEs on one page: Cisco vulnerabilities actively exploited.

Authoritative references