Vulnerabilities ›

CVE-2026-20182

Critical 🇺🇸 CISA KEV

                    Published: May 14, 2026                                          ·  Source: CISA_KEV                

CVSS v3

9.8

🔗 NVD Official

📄 Description (English)

Cisco Catalyst SD-WAN — CVE-2026-20182
Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.

Required Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Due Date: 2026-05-17

🤖 AI Executive Summary

Cisco Catalyst SD-WAN Controller & Manager contains a critical authentication bypass vulnerability (CVSS 9.8) allowing unauthenticated remote attackers to gain administrative privileges. This poses an immediate threat to Saudi organizations relying on SD-WAN for enterprise network connectivity. No patch is currently available, requiring immediate implementation of compensating controls and network segmentation.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: May 15, 2026 03:16

🇸🇦 Saudi Arabia Impact Assessment

Critical impact on Saudi banking sector (SAMA-regulated institutions), government agencies (NCA oversight), telecommunications providers (STC, Mobily), energy sector (ARAMCO, SEC), and healthcare organizations. SD-WAN is widely deployed for branch connectivity and cloud access across these sectors. Unauthorized administrative access could enable data exfiltration, network manipulation, lateral movement, and service disruption affecting critical national infrastructure.

🏢 Affected Saudi Sectors

Banking & Financial Services (SAMA-regulated) Government & Public Administration (NCA oversight) Telecommunications (STC, Mobily, Zain) Energy & Oil & Gas (ARAMCO, SEC) Healthcare & Pharmaceuticals Education & Universities Transportation & Logistics Retail & E-commerce

🎯 MITRE ATT&CK Techniques

T1190 - Exploit Public-Facing Application T1133 - External Remote Services T1078 - Valid Accounts T1556 - Modify Authentication Process T1021 - Remote Services T1059 - Command and Scripting Interpreter T1087 - Account Discovery T1005 - Data from Local System

⚖️ Saudi Risk Score (AI)

9.7

/ 10.0

🔧 Remediation Steps (English)

IMMEDIATE ACTIONS:

1. Inventory all Cisco Catalyst SD-WAN Controller and Manager instances across your organization

2. Isolate affected SD-WAN controllers from untrusted networks immediately

3. Implement network segmentation: restrict access to SD-WAN management interfaces to authorized IP ranges only

4. Enable VPN/IPsec for all remote management access to SD-WAN controllers

5. Implement strict firewall rules limiting access to ports 443, 8443, and management interfaces

6. Monitor all authentication attempts and administrative access logs for anomalies

7. Disable unnecessary management protocols (HTTP, Telnet) and enforce HTTPS only

8. Implement multi-factor authentication (MFA) for all administrative accounts

9. Deploy intrusion detection/prevention systems (IDS/IPS) to monitor SD-WAN traffic

10. Establish 24/7 monitoring for unauthorized access attempts

11. Prepare incident response procedures for potential compromise

12. Contact Cisco TAC for patch availability timeline and interim guidance

13. Document all compensating controls implemented

14. Conduct security assessment of SD-WAN infrastructure for signs of compromise

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. قم بحصر جميع أجهزة التحكم في Cisco Catalyst SD-WAN والمديرين عبر مؤسستك

2. عزل أجهزة التحكم المتأثرة بـ SD-WAN عن الشبكات غير الموثوقة فوراً

3. تنفيذ تقسيم الشبكة: تقييد الوصول إلى واجهات إدارة SD-WAN للنطاقات المصرح بها فقط

4. تفعيل VPN/IPsec لجميع الوصول الإداري عن بعد إلى أجهزة التحكم

5. تنفيذ قواعد جدار الحماية الصارمة لتقييد الوصول إلى المنافذ 443 و 8443 وواجهات الإدارة

6. مراقبة جميع محاولات المصادقة والوصول الإداري للكشف عن الشذوذ

7. تعطيل بروتوكولات الإدارة غير الضرورية (HTTP و Telnet) وفرض HTTPS فقط

8. تنفيذ المصادقة متعددة العوامل (MFA) لجميع الحسابات الإدارية

9. نشر أنظمة كشف/منع الاختراق (IDS/IPS) لمراقبة حركة SD-WAN

10. إنشاء مراقبة 24/7 لمحاولات الوصول غير المصرح بها

11. تحضير إجراءات الاستجابة للحوادث للتسويات المحتملة

12. التواصل مع Cisco TAC للحصول على جدول توفر التصحيح والإرشادات المؤقتة

13. توثيق جميع الضوابط البديلة المنفذة

14. إجراء تقييم أمني لبنية SD-WAN للبحث عن علامات التسويات

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 A.9.2.1 - User registration and access rights management ECC 2024 A.9.4.3 - Password management systems ECC 2024 A.9.1.1 - Access control policy ECC 2024 A.14.2.1 - Secure development policy ECC 2024 A.12.6.1 - Management of technical vulnerabilities

🔵 SAMA CSF

SAMA CSF ID.AM-2 - Hardware and software assets are catalogued SAMA CSF PR.AC-1 - Identities and credentials are issued and managed SAMA CSF PR.AC-3 - Access is managed based on the principle of least privilege SAMA CSF PR.AC-4 - Access is managed through multi-factor authentication SAMA CSF DE.CM-1 - The network is monitored to detect potential cybersecurity events

🟡 ISO 27001:2022

ISO 27001:2022 A.5.15 - Access control ISO 27001:2022 A.5.16 - Authentication ISO 27001:2022 A.5.17 - Access rights ISO 27001:2022 A.8.1 - User endpoint devices ISO 27001:2022 A.8.22 - Monitoring

🟣 PCI DSS v4.0.1

PCI DSS 2.1 - Default security parameters PCI DSS 6.2 - Security patches and updates PCI DSS 7.1 - Limit access to system components PCI DSS 8.1 - User identification and authentication

🔗 References & Sources 0

No references.

📊 CVSS Score

9.8

/ 10.0 — Critical

📋 Quick Facts

Severity Critical

CVSS Score9.8

EPSS77.32%

Exploit No

Patch ✗ No

CISA KEV🇺🇸 Yes

Published 2026-05-14

Source Feed cisa_kev

🇸🇦 Saudi Risk Score

9.7

/ 10.0 — Saudi Risk

Priority: CRITICAL

🏷️ Tags

kev cisa exploit-known

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2026-20182

Introduce Yourself

Sign In Required