THE THREAT

On May 14th, 2026, Cisco disclosed a maximum severity vulnerability in Cisco Catalyst Software-Defined Wide Area Network (SD-WAN) Controller and SD-WAN Manager. The vulnerability, tracked as CVE-2026-20182 (CVSS: 10) allows a remote, unauthenticated attacker to bypass authentication and gain administrative privileges on affected systems. Cisco Talos has confirmed real-world exploitation occurred prior to the release of security patches.

Organizations utilizing Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager need to apply the relevant security patches immediately.

What we're doing about it

eSentire's Threat Response Unit (TRU) has created new MDR for Network detections to identify exploitation attempts
Malicious infrastructure associated with exploitation of Cisco devices is blocked for eSentire MDR for Network customers, via the eSentire Global Block List
Threat hunting for Indicators of Compromise (IoCs) associated with Cisco exploitation is ongoing
eSentire's Managed Vulnerability Service (MVS) has plugins for CVE-2026-20182 listed as "Coming Soon"
- Plugins are in place to identify devices vulnerable to CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122
eSentire TRU is tracking the topic for additional details and detection opportunities

What you should do about it

After performing a business impact review, apply the relevant security patches
- Cisco recommends that organizations "issue the request admin-tech command from each of the control components in the SD-WAN deployment before upgrading" to preserve possible IoCs
Search for signs of compromise by auditing the "auth.log" file for unauthorized IP addresses; Cisco provides instructions in the vulnerability release

Additional information

Following the disclosure of CVE-2026-20182, Cisco Talos published details regarding the attacks that were identified to have leveraged the vulnerability. Cisco Talos tracks the threat actor behind the attacks as UAT-8616, which they previously linked to attacks targeting another zero-day vulnerability impacting Cisco Catalyst SD-Wan Controller, CVE-2026-20127 (CVSS: 10), in February 2026. Cisco Talos assesses that UAT-8616 is a "highly sophisticated cyber threat actor" but does not provide any additional background information. In attacks targeting CVE-2026-20182, UAT-8616 was identified as adding SSH keys, modifying Network Configuration Protocol (NETCONF) configurations, and elevating to root privileges; these were identified as similar tactics used by the group during the February 2026 attacks.

Cisco Talos also identified attacks targeting three additional vulnerabilities within Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-20133 (CVSS: 7.5), CVE-2026-20128 (CVSS: 7.5), and CVE-2026-20122 (CVSS: 5.4). All three vulnerabilities were disclosed along with security patches in February 2026. These attacks were not attributed to UAT-8616; Cisco Talos identified a total of 10 clusters of threat actors leveraging the vulnerabilities within attacks, resulting in the deployment of webshell (Godzilla, Behinder, XenShell), Command-and-Control (C2) frameworks (AdaptixC2, Sliver), the XMRig coin miner, and an unidentified credential stealer payload. Cisco Talos notes that the publicly available Proof-of-Concept (PoC) exploit code for these vulnerabilities was used by the threat actors within the attacks.

In response to Cisco's disclosure and confirmed exploitation of CVE-2026-20182, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, giving Federal Civilian Executive Branch (FCEB) agencies a deadline of May 17th to apply relevant security patches. Given confirmed exploitation, organizations utilizing Cisco Catalyst SD-WAN Controller and SD-WAN Manager products should ensure that the relevant patches to address CVE-2026-20182 and the other outlined flaws are applied as soon as possible. eSentire published an advisory for CVE-2026-20127 on February 25th, 2026.

Cisco Catalyst SD-WAN Versions
Vulnerable	Fixed Release
Earlier than 20.9	Migrate to a fixed release.
20.9	20.9.9.1
20.10	20.12.7.1
20.11	20.12.7.1
20.12	20.12.5.4 20.12.6.2 20.12.7.1
20.13	20.15.5.2
20.14	20.15.5.2
20.15	20.15.4.4 20.15.5.2
20.16	20.18.2.2
20.18	20.18.2.2
26.1	26.1.1.1

Versions earlier than 20.9, as well as versions 20.11, 20.13, 20.14, and 20.16 have reached End-of-Life (EoL) status, and should be replaced.

Indicators of Compromise (IOCs) Provided by Cisco
38[.]181[.]52[.]89	Attacker IP Address
89[.]125[.]244[.]33	Attacker IP Address
89[.]125[.]244[.]51	Attacker IP Address
71[.]80[.]85[.]135	Attacker IP Address
212[.]83[.]162[.]37	Attacker IP Address
38[.]60[.]214[.]92	Attacker IP Address
65[.]20[.]67[.]134	Attacker IP Address
104[.]233[.]156[.]1	Attacker IP Address
194[.]233[.]100[.]40	Attacker IP Address
194[.]163[.]175[.]135	AdaptixC2 C2 IP Address
23[.]27[.]143[.]170	Sliver C2 IP Address
83[.]229[.]126[.]195	XMRig C2 IP Address
79[.]135[.]105[.]208	Backdoor C2 IP Address
13[.]62[.]52[.]206	Backdoor C2 IP Address
176[.]65[.]139[.]31	Backdoor C2 IP Address
47[.]104[.]248[.]7	Coin miner C2 IP Address
mtls[://]23.27.143[.]170:44	Sliver C2 Domain
hxxp://83[.]229[.]126[.]195:8081/xmrig	XMRig Download Domain
hxxp://83[.]229[.]126[.]195:8081/config[.]json	XMRig Configuration File Domain
hxxps://1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p[.]worf[.]replit[.]dev/download	Backdoor Download Domain
hxxp://13[.]62[.]52[.]206:5004	Backdoor C2 Domain
f6f8e0d790645395188fc521039385b7c4f42fa8b426fd035f489f6cda9b5da1	AdaptixC2 SHA256 Hash
02654acfb21f83485393ba8b14bd8862b919b9ec966fc6768f6aac1338a45ee8	Sliver SHA256 Hash
0ed72d52347bfe4a78afff8a6982a64050c8fc86d8957a20eeb3e0f3f5342ed0	XMRig SHA256 Hash
96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46	XMRig SHA256 Hash
7aa88a64a527ade7d93c20faf23b54f2ee33ad9b1246cdc2f8ded2ab639affb1	XMRig SHA256 Hash
0c87871642f84e09e8d3fb23ec36bf55601323e31151a7017a85dbec929cf15d	Backdoor SHA256 Hash
18d77c9c5bbb5b9d5bdfd366fdfcf26bad9e64c63ca865fad711bcce8e3d5a80	KScan SHA256 Hash
d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa	GSocket SHA256 Hash
b0f51b098842cd630097b462aab0ec357e2c7824af37cca6d08165265da2c2d3	SHA256 Hash of Credential Stealer
72f570ce97de3eaaffef33d90b0c337a153fc9690cc34ee207b557d868360060	SHA256 Hash of Malicious Script
17302d903baf182f94dc3be40ab1e0874dd0eb2ec5255bf9131fd53591efe925	SHA256 Hash of Malicious Script

References:
[1] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-20182
[3] https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
[4] https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/225842-remediate-catalyst-sd-wan-security.html
[5] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW#:~:text=audit%20the%20auth.log%20file
[6] https://blog.talosintelligence.com/uat-8616-sd-wan/
[7] https://nvd.nist.gov/vuln/detail/CVE-2026-20127
[8] https://nvd.nist.gov/vuln/detail/CVE-2026-20133
[9] https://nvd.nist.gov/vuln/detail/CVE-2026-20128
[10] https://nvd.nist.gov/vuln/detail/CVE-2026-20122
[11] https://www.cisa.gov/news-events/alerts/2026/05/14/cisa-adds-one-known-exploited-vulnerability-catalog
[12] https://www.esentire.com/security-advisories/cve-2026-20127-cisco-catalyst-zero-day-vulnerability

Back to Security Advisories

Speak With A Security Expert Now

TALK TO AN EXPERT

Security advisories

Cisco Catalyst SD-WAN Zero-Day Vulnerability (CVE-2026-20182)

THE THREAT

What we're doing about it

What you should do about it

Additional information

Speak With A Security Expert Now

in this Advisory