CISA Orders Federal Agencies to Patch Critical Cisco SD-WAN CVE-2026-20182 by May 17 as UAT-8616 Exploits Maximum-Severity Auth Bypass

The US Cybersecurity and Infrastructure Security Agency added Cisco Catalyst SD-WAN Controller flaw CVE-2026-20182 to its Known Exploited Vulnerabilities catalog, ordering Federal Civilian Executive Branch agencies to remediate by May 17, 2026. The authentication bypass scores a maximum 10.0 on CVSS and lets unauthenticated remote attackers gain administrative privileges over the vdaemon DTLS service on UDP port 12346.

Cisco Talos attributed active exploitation with high confidence to threat cluster UAT-8616, the same group that weaponized CVE-2026-20127 earlier this year. Observed post-compromise activity includes injecting attacker-controlled SSH keys into the vmanage-admin account, modifying NETCONF configurations, escalating to root, and deploying XenShell, Godzilla and Behinder web shells. Public proof-of-concept code is now circulating.

The bug affects both Cisco Catalyst SD-WAN Controller (formerly vSmart) and SD-WAN Manager (formerly vManage). Cisco disclosed it on May 15, with exploitation across at least ten distinct threat clusters traced back to March 2026.