Cisco Catalyst SD-WAN Controller: Schwachstelle ermöglicht Erlangen von Administratorrechten
WID-SEC-2026-1534 · first 15.05.2026 · updated 15.05.2026 · CVSS 10,0
What it is about
Catalyst ist der Markenname für eine Vielzahl von Netzwerk-Switches die von Cisco Systems verkauft werden. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Catalyst SD-WAN Controller ausnutzen, um Administratorrechte zu erlangen und so die Netzwerkkonfiguration für die SD-WAN-Struktur zu manipulieren.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- Administratorrechte zu erlangen
- so die Netzwerkkonfiguration für die SD-WAN-Struktur zu manipulieren
Am I affected?
Affected according to the BSI:
- Cisco Catalyst SD-WAN Controller <26.1.1.1
- Cisco Catalyst SD-WAN Controller <20.18.2.2
- Cisco Catalyst SD-WAN Controller <20.15.4.4
- Cisco Catalyst SD-WAN Controller <20.15.5.2
- Cisco Catalyst SD-WAN Controller <20.12.6.2
- Cisco Catalyst SD-WAN Controller <20.12.5.4
- Cisco Catalyst SD-WAN Controller <20.12.7.1
- Cisco Catalyst SD-WAN Controller <20.9.9.1
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Cisco Catalyst SD-WAN Controller 26.1.1.1
- Cisco Catalyst SD-WAN Controller 20.18.2.2
- Cisco Catalyst SD-WAN Controller 20.15.4.4
- Cisco Catalyst SD-WAN Controller 20.15.5.2
- Cisco Catalyst SD-WAN Controller 20.12.6.2
- Cisco Catalyst SD-WAN Controller 20.12.5.4
- Cisco Catalyst SD-WAN Controller 20.12.7.1
- Cisco Catalyst SD-WAN Controller 20.9.9.1
Is the vulnerability already being exploited?
- CVE-2026-20182: exploited in the wild according to CISA, in the catalogue since 14.05.2026.
Information and sources
- Original BSI advisory (WID)
- Cisco Security Advisory cisco-sa-sdwan-rpa2-v69WY2SW vom 2026-05-14 sec.cloudapps.cisco.com
- CISA KEV: CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability vom 2026-05-14 www.cisa.gov
CVE: CVE-2026-20182
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.