CVE-2026-20182 — Cisco Catalyst SD-WAN Controller / Manager Authentication Bypass

A proof-of-concept exploit for CVE-2026-20182, a critical (CVSS 10.0) authentication bypass in the vdaemon DTLS service (UDP/12346) on Cisco Catalyst SD-WAN Controller (vSmart) and Manager (vManage).

Disclosed: May 14, 2026 by Rapid7 (Stephen Fewer & Jonah Burgess)
CISA KEV: Added May 14, 2026 (Emergency Directive 26-03)
CVSS: 10.0 — CWE-287: Improper Authentication

Vulnerability

The vdaemon service uses a multi-phase DTLS handshake to authenticate control-plane peers. The vbond_proc_challenge_ack() function implements device-type-specific certificate verification — but device type 2 (vHub) has no verification code path. Sending a CHALLENGE_ACK with device_type=2 causes the function to fall through every conditional and unconditionally set peer->authenticated = 1.

No valid credentials, no CA-signed certificate, and no knowledge of the SD-WAN deployment are required.

What the Exploit Does

1. Establishes a DTLS 1.2 connection to the target's vdaemon service (UDP/12346)
2. Receives the CHALLENGE message (msg_type=8)
3. Sends CHALLENGE_ACK claiming to be a vHub (device_type=2) → peer is marked authenticated
4. Sends HELLO (msg_type=5) → peer transitions to UP state
5. Injects an SSH public key into /home/vmanage-admin/.ssh/authorized_keys via MSG_VMANAGE_TO_PEER (msg_type=14)
6. Grants NETCONF access (SSH TCP/830) or SSH access (TCP/22) as vmanage-admin

Usage

python3 cve-2026-20182.py -t <target> [options]

Options

Examples

# Generate a fresh key pair and exploit
python3 cve-2026-20182.py -t 192.168.1.100

# Use an existing public key
python3 cve-2026-20182.py -t 192.168.1.100 --key-file ~/.ssh/id_rsa.pub

# Exploit and verify via NETCONF
python3 cve-2026-20182.py -t 192.168.1.100 --netconf

Output

[*] Targeting 192.168.1.100:12346 (vdaemon DTLS)
[+] DTLS handshake complete (received msg_type=8, 1027 bytes)
[*] Sending CHALLENGE_ACK with device_type=2 (vHub) ...
[+] peer->authenticated = 1 (authentication bypassed!)
[*] Sending HELLO ...
[+] Peer is UP state (peering handshake bypass successful)
[*] Injecting SSH public key ...

[+] NETCONF: ssh -i /tmp/cve-2026-20182_key -o HostKeyAlgorithms=+ssh-rsa -p 830 [email protected]
[+] SSH:     ssh -i /tmp/cve-2026-20182_key -o HostKeyAlgorithms=+ssh-rsa [email protected]

Affected Versions

Research References

• Rapid7 (Original Disclosure): CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller — Full technical analysis, decompiled code, and protocol details by Stephen Fewer & Jonah Burgess
• Cisco Security Advisory: cisco-sa-sdwan-rpa2-v69WY2SW — Vendor advisory with fixed versions
• CISA KEV: CVE-2026-20182 — Emergency Directive 26-03 (remediation by May 17, 2026)
• NVD: CVE-2026-20182 — National Vulnerability Database entry
• Rapid7 Metasploit Module: cisco_sdwan_vhub_auth_bypass — Auxiliary module in Metasploit framework
• BleepingComputer: Cisco warns of new critical SD-WAN flaw exploited in zero-day attacks
• Tenable: FAQ about the continued exploitation of Cisco SD-WAN vulnerabilities
• Cisco Talos: Threat actor UAT-8616 attributed to exploiting this vulnerability in the wild

Technical Details

The vdaemon protocol header is 12 bytes:

Device types: 1=vEdge, 2=vHub, 3=vSmart, 4=vBond, 5=vManage

Requirements

• Python 3.7+
• openssl CLI (for DTLS transport)
• cryptography library (pip install cryptography)

Disclaimer

This exploit is intended solely for authorized red team operations, penetration testing, and security research on systems where you have explicit written permission. Unauthorized use is illegal.