U.S. CISA adds a flaw in Cisco Catalyst SD-WAN  to its Known Exploited Vulnerabilities catalog

U.S. CISA has added CVE-2026-20182 (CVSS 10.0), an authentication bypass in Cisco Catalyst SD-WAN Controller (vSmart) and Manager (vManage), to its Known Exploited Vulnerabilities catalog. The flaw in the vdaemon DTLS service (UDP 12346) allows an unauthenticated remote attacker to impersonate a trusted peer, obtain a high-privilege internal account, inject SSH keys, access NETCONF (TCP 830), and alter SD-WAN network configurations; Cisco reported limited in-the-wild exploitation and urges urgent upgrades with a federal remediation deadline of May 17, 2026.