{"id":929,"date":"2026-05-15T05:49:16","date_gmt":"2026-05-15T05:49:16","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=929"},"modified":"2026-05-15T05:49:16","modified_gmt":"2026-05-15T05:49:16","slug":"cisa-adds-cisco-sd-wan-cve-2026-20182-to-kev-after-admin-access-exploits","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=929","title":{"rendered":"CISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access Exploits"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>May 15, 2026<\/span><\/span>Vulnerability \/ Credential Theft<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The U.S.Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added<\/a> a newly disclosed vulnerability impacting Cisco Catalyst SD-WAN Controller to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate the issue by May 17, 2026.<\/p>\n

The vulnerability is a critical authentication bypass tracked as CVE-2026-20182<\/strong>. It’s rated 10.0 on the CVSS scoring system, indicating maximum severity.<\/p>\n

\u00abCisco Catalyst SD-WAN Controller and Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system,\u00bb CISA said<\/a>.<\/p>\n

In a separate advisory, Cisco attributed<\/a> the active exploitation of CVE-2026-20182 with high confidence to UAT-8616, the same cluster behind the weaponization of CVE-2026-20127 to gain unauthorized access to SD-WAN systems.<\/p>\n

\u00abUAT-8616 performed similar post-compromise actions after successfully exploiting CVE-2026-20182, as was observed in the exploitation of CVE-2026-20127 by the same threat actor,\u00bb Cisco Talos said. \u00abUAT-8616 attempted to add SSH keys, modify NETCONF configurations, and escalate to root privileges.\u00bb<\/p>\n

It’s assessed that the infrastructure used by UAT-8616 to carry out exploitation and post-compromise activities overlaps with Operational Relay Box (ORB) networks, with the cybersecurity company also observing multiple threat clusters exploiting CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 beginning March 2026.<\/p>\n

The three vulnerabilities, when chained together, can allow a remote unauthenticated attacker to gain unauthorized access to the device. They were added to the CISA’s KEV catalog last month.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The activity has been found to leverage publicly available proof-of-concept exploit code to deploy web shells on hacked systems, allowing the operators to run arbitrary bash commands. One such JavaServer Pages (JSP)-based web shell has been codenamed XenShell owing to the use of a PoC released by ZeroZenX Labs.<\/p>\n

At least 10 different clusters have been linked to the exploitation of the three flaws –<\/p>\n