Cisco warns of new critical SD-WAN flaw exploited in zero-day attacks

Cisco warns of CVE-2026-20182, a critical (CVSS 10.0) authentication-bypass in Catalyst SD‑WAN Controller and Manager that has been actively exploited to gain administrative (non-root) access, enabling NETCONF access and the registration of rogue peers; Cisco released patches, recommends restricting management interfaces and reviewing /var/log/auth.log and SD‑WAN peering logs for IOCs, and CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog.