CISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access Exploits

CISA added a critical CVE-2026-20182 (CVSS 10.0) affecting Cisco Catalyst SD‑WAN Controller to its Known Exploited Vulnerabilities catalog after active exploitation attributed to UAT-8616; attackers bypass authentication to obtain administrative privileges and deploy web shells (XenShell, Godzilla, Behinder), multiple C2 frameworks, miners, and a credential stealer that attempts to exfiltrate admin hashes, JWT key chunks, and AWS credentials—CISA and Cisco recommend immediate remediation per their advisories.