CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller (FIXED)
2026-05-14T19:23:46Z•a3261892c0bdcaac0638fc7f0f9fcbe966fa90b6155f37221f9be22449339531
Cisco Catalyst SD-WAN ControllerDTLSModeloRATPatch TuesdaySD-WANUDP/12346authentication bypasspatch availableprivilege escalationpublic-key injectionremote unauthenticatedvdaemon
What happened
Rapid7 disclosed CVE-2026-20182, a critical authentication bypass in Cisco Catalyst SD‑WAN Controller (formerly vSmart) affecting the “vdaemon” service over DTLS (UDP/12346). The flaw—distinct from but in the same vdaemon networking stack as CVE-2026-20127—allows a remote unauthenticated attacker to present as an authenticated peer and perform privileged operations (for example, injecting an attacker-controlled public key into vmanage-admin). Cisco has published a fix; defenders should prioritize installing vendor updates and mitigations. The Rapid7 feed also references related high‑impact vul
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- a3261892c0bdcaac0638fc7f0f9fcbe966fa90b6155f37221f9be22449339531
- Enrichment time
- 2026-05-14T19:23:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.