sign in--:--:--UTC

CVE-2026-20182

exploited in the wild

CVSS

10.0

Reports

18

First seen

May 14

Last seen

Jun 25

Affected product

Cisco Catalyst SD-WAN Controller

Associated actors

UAT-8616 ×6 ShinyHunters ×1 TeamPCP ×1

Recent reports

Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited for Root Access

The Hacker NewsJun 25 High

Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access

Bleeping ComputerJun 24 Critical

Attacker exploits Cisco SD-WAN zero-day to gain root access at communications service provider

CyberScoopJun 24 High

Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw

The Hacker NewsJun 16 Critical

Cisco fixes SD-WAN vManage zero-day flaw exploited in privilege-escalation attacks

Bleeping ComputerJun 15 High

Cisco SD-WAN Manager Zero-Day Under Active Exploitation

CyberScoopJun 9 High

Cisco Catalyst SD-WAN Manager CVE-2026-20245 Actively Exploited – Patch Unavailable

The Hacker NewsJun 6 High

Cisco warns of unpatched SD-WAN zero-day exploited in attacks

Bleeping ComputerJun 5 Critical

Max severity Cisco Secure Workload flaw gives Site Admin privileges

Bleeping ComputerMay 21 Critical

Cisco Catalyst SD-WAN Authentication Bypass Vulnerability (CVE-2026-20182)

NICS TaiwanMay 21 High

Weekly Threat Recap: Exchange 0-Day, npm Supply Chain Attacks, Cisco Exploits

The Hacker NewsMay 18 Critical

Critical vulnerability in Cisco Catalyst SD-WAN (CVE-2026-20182) under active exploitation

Canadian Centre AlertsMay 15 Critical

CISA Adds Cisco SD-WAN Authentication Bypass CVE-2026-20182 to KEV Catalog

The Hacker NewsMay 15 High

Multiple Vulnerabilities in Cisco Products – CVE-2026-20182 Exploited in Wild

GovCERT.HKMay 15 Critical

Cisco security advisory AV26-471: Critical vulnerabilities in Catalyst SD-WAN

Canadian Centre AlertsMay 14 Critical

Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited for Admin Access

The Hacker NewsMay 14 High

Cisco Talos tracks active exploitation of Catalyst SD-WAN vulnerabilities

Cisco TalosMay 14 High

CISA Adds Cisco Catalyst SD-WAN Authentication Bypass to Known Exploited Vulnerabilities Catalog

CISA AdvisoriesMay 14

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans