{"data":{"id":1664,"lang":"en","title":"CISA Orders Federal Agencies to Patch Critical Cisco SD-WAN CVE-2026-20182 by May 17 as UAT-8616 Exploits Maximum-Severity Auth Bypass","summary":"CISA added Cisco Catalyst SD-WAN flaw CVE-2026-20182 (CVSS 10.0) to its KEV catalog with a May 17 federal patch deadline; threat actor UAT-8616 is exploiting the auth bypass for admin access.","category":"technology","category_label":"Technology","published_at":"2026-05-17T14:01:33Z","updated_at":"2026-05-17T14:01:33Z","url":"https://techtools.cz/tools/news/article/1664-cisa-orders-federal-agencies-to-patch-critical-cisco-sd-wan-cve-2026-20182-by","api_url":"https://techtools.cz/news-api/v1/articles/1664?lang=en","markdown_url":"https://techtools.cz/news-api/v1/articles/1664.md?lang=en","image_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4XG5z00sF3uL0ZbhtZNiergQ9QVaZJydwP1pXEdPh2o29mwvTS2nPKRbxHftwnEJ1pvxMQS9TQknWqbovk-vW7BRPHUSsBhN4yL2iOwJnlmK7lzCdW9tJbKtKLbnfSZSWgfGlWQ6HO807gjR6dP61VylH1zxWtvfo3c7ui8aBecSjVz5miCG0jHoa8rUA/s1700-e365/cisa-exploit.png","word_count":146,"reading_time_minutes":1,"sources":[{"url":"https://thehackernews.com/2026/05/cisa-adds-cisco-sd-wan-cve-2026-20182.html","domain":"thehackernews.com"},{"url":"https://www.helpnetsecurity.com/2026/05/15/cisco-sd-wan-zero-day-cve-2026-20182/","domain":"helpnetsecurity.com"},{"url":"https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/","domain":"blog.talosintelligence.com"}],"translation":{"lang":"cs","id":1737,"title":"CISA nařídila federálním úřadům opravit kritickou zranitelnost Cisco SD-WAN CVE-2026-20182 do 17. května, skupina UAT-8616 zneužívá obejití autentizace s maximální závažností","url":"https://techtools.cz/tools/news/clanek/1737-cisa-naridila-federalnim-uradum-opravit-kritickou-zranitelnost-cisco-sd-wan-cve","api_url":"https://techtools.cz/news-api/v1/articles/1737?lang=cs"},"content":"The US Cybersecurity and Infrastructure Security Agency added Cisco Catalyst SD-WAN Controller flaw CVE-2026-20182 to its Known Exploited Vulnerabilities catalog, ordering Federal Civilian Executive Branch agencies to remediate by May 17, 2026. The authentication bypass scores a maximum 10.0 on CVSS and lets unauthenticated remote attackers gain administrative privileges over the vdaemon DTLS service on UDP port 12346.\n\nCisco Talos attributed active exploitation with high confidence to threat cluster UAT-8616, the same group that weaponized CVE-2026-20127 earlier this year. Observed post-compromise activity includes injecting attacker-controlled SSH keys into the vmanage-admin account, modifying NETCONF configurations, escalating to root, and deploying XenShell, Godzilla and Behinder web shells. Public proof-of-concept code is now circulating.\n\nThe bug affects both Cisco Catalyst SD-WAN Controller (formerly vSmart) and SD-WAN Manager (formerly vManage). Cisco disclosed it on May 15, with exploitation across at least ten distinct threat clusters traced back to March 2026."}}