Multiple critical authentication bypass vulnerabilities in Cisco Catalyst SD-WAN Controller and Manager are under active exploitation. CVE-2026-20182 (CVSSv3 10.0) was disclosed May 14, 2026, and is being exploited as a zero-day by a sophisticated threat actor designated UAT-8616, which has targeted Cisco SD-WAN infrastructure since at least 2023. Ten additional threat clusters began exploiting a related CVE chain (CVE-2026-20133, CVE-2026-20128, CVE-2026-20122) after public PoC code was released. Successful exploitation grants privileged access to SD-WAN Controllers, enabling NETCONF-based network configuration manipulation across the entire SD-WAN fabric. Post-compromise activities include SSH key injection, malicious account creation, and log clearing. CISA issued Emergency Directive 26-03 with a May 17 remediation deadline and added all five CVEs to its Known Exploited Vulnerabilities catalog. Patches are available for all supported releases. IoCs include suspicious auth.log entries, unauthorized SSH keys, and unexpected software downgrades.
