Zero-Day Threat Targets Cisco Catalyst SD-WAN Fabric

Rapid7 Labs discovered a zero-day vulnerability in Cisco Catalyst SD-WAN Controller affecting its users worldwide. As reported in its May 14, 2026, blog post, Rapid7 said the vulnerability leaves the SD-WAN Controller critically exposed until a patch is applied. Cisco has released a patch to address the security flaw and recommends that all users apply it as soon as possible.

vHub Vulnerability

The reported vulnerability, tracked as CVE-2026-20182, exploits a flaw in vHub authentication. Attackers can self-identify as a vHub to gain access to privileged connections. From there, the attacker connects to the vmanage-admin account, giving them continued access to the system.

The vulnerability could cause significant problems without IT administrators being aware of the attack. One potential risk is data extraction. Attackers with administrator access could monitor network traffic and extract information they consider valuable for future use. Cisco’s Security Advisory has also laid out the possible results of a successful attack:

“A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.”

Another risk is network connectivity issues. Attackers may not have full network control, but their access is more than enough to cause issues within the network.

Response History

Rapid7 discovered the vulnerability on March 9, 2026, and immediately notified Cisco. Cisco responded on the same day about the vulnerability, formally reserving a CVE (Common Vulnerabilities and Exposures) code on March 20, 2026. Cisco initially requested disclosure on May 7, 2026, but later requested to move the disclosure to May 14, 2026.

No workaround has been reported to replace the patch released by Cisco. An update is necessary to address this vulnerability.

Checking for Vulnerabilities and Reporting Issues

While no actual attacks have been reported, IT administrators can still check their networks for signs of potential exploitation. According to Bleeping Computer, unknown IP addresses logged in vmanage-admin should be blocked and investigated immediately:

“Cisco also recommends reviewing SD-WAN Controller logs for unauthorized peering activity, as attackers may attempt to register rogue devices within the SD-WAN fabric.”

One of the biggest challenges for IT administrators is determining whether their network has been compromised. If a vulnerability exists, administrators have to comb through their network to determine which connections and users have been affected. Cisco Catalyst SD-WAN Controller is used worldwide by private and government institutions alike, and any affected controller could mean weeks of manpower just for diagnosis.

Cisco’s Technical Assistance Center (TAC) has also provided steps for addressing the issue if a vulnerability is detected. It’s a serious issue that should be patched and addressed immediately.

Vulnerabilities like this remind IT administrators that vulnerabilities exist and they should be alert to unknown IP address connectivity. Bad actors are always looking for ways to gain unauthorized access to systems for malicious purposes, potentially disrupting major businesses and even government operations.