Maximum Severity Cisco SD-WAN Bug Exploited in the Wild

A critical CVSS 10.0 authentication bypass vulnerability (CVE-2026-20182) in Cisco Catalyst SD-WAN Controllers is being actively exploited in the wild by a threat actor tracked as UAT-8616. This is the second maximum-severity authentication bypass in the same product line this year — the first (CVE-2026-20127) was patched in February, but UAT-8616 quickly pivoted to the new flaw. The vulnerability allows unauthenticated attackers to gain administrative privileges by exploiting improper verification of vHub cloud routers, then access NETCONF to manipulate network configurations and escalate to root. Researchers at Cisco Talos and Rapid7 note the actor's overlap with Chinese ORB networks and possible critical infrastructure targeting. Organizations are urged to apply Cisco's newly released patch immediately.