Cisco SD-WAN Authentication Bypass (CVSS 10.0): CVE-2026-20182

Attack Overview

A maximum-severity authentication bypass vulnerability (CVE-2026-20182) has been identified in the Cisco Catalyst SD-WAN Controller and Manager. With a CVSS score of 10.0, this flaw allows unauthenticated remote attackers to establish trusted control-plane connections, leading to full administrative takeover of the SD-WAN fabric. The vulnerability is currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.

Step-by-Step Execution

Exploitation follows a specific sequence within the DTLS control plane:

1. Initiation: The attacker initiates a DTLS handshake with the target Cisco SD-WAN Controller/Manager on UDP port 12346.
2. Challenge: The target system issues an authentication challenge.
3. Spoofing: The attacker responds with a crafted CHALLENGE_ACK packet, explicitly setting the device type field to 2 (vHub).
4. Bypass: The vdaemon service skips certificate validation based on the device type and establishes an authenticated session.
5. Impact: Using the established session, the attacker sends VMANAGE_TO_PEER messages to inject an SSH public key into the vmanage-admin account, granting persistent root-level access.

Code-Level Mechanics

The vulnerability resides in the vdaemon service, which listens on UDP port 12346 and manages DTLS control-plane communications between SD-WAN components.

The flaw is a fundamental logic error in the peering authentication process. During the DTLS handshake challenge-response phase, if a connecting peer identifies itself as a 'vHub' (device type 2), the service fails to perform mandatory certificate verification. This oversight allows an unauthenticated attacker to bypass the entire security handshake and establish what the system considers a "trusted" connection.

Payload Behavior

While the exact payload binary is not public, the primary payload behavior involves the transmission of a crafted CHALLENGE_ACK packet. This packet contains a specific bitmask or field identifying the device as a 'vHub'. Once the trusted session is established, the attacker utilizes the VMANAGE_TO_PEER protocol messages to manipulate the file system or configuration database, specifically targeting the SSH authorized keys of the vmanage-admin account.

Detection Opportunities

Defenders should prioritize the following telemetry and audit steps:

• Control Connection Audit: Execute show control connections and investigate any unexpected vHub device entries or connections from unknown IP addresses.
• Log Monitoring: Monitor system logs for unauthorized SSH key additions to the vmanage-admin account.
• DTLS Analysis: Analyze DTLS handshake logs for unusual peering attempts or spoofed device identifiers.
• Network Filtering: Restrict access to UDP port 12346 strictly to known, authorized peer IP addresses.

Evidence Gaps

Currently, there is no publicly available proof-of-concept (PoC) code for the packet crafting. Additionally, the specific version numbers of the vdaemon binary that first introduced this logic error are not fully documented in the public advisory, though all recent versions are assumed vulnerable until patched. The full range of VMANAGE_TO_PEER commands available to an unauthenticated peer is also not publicly enumerated.

# Detection via CLI
show control connections | match vHub