runZero is now a Dragos company. Read the press release →

runZero CAASM

On This Page:

  1. Critical Cisco Catalyst SD-WAN vulnerability: CVE-2026-76504
  2. What is Cisco Catalyst SD-WAN Manager?
  3. What is the impact?
  4. Are updates or workarounds available?
  5. Finding exposed systems with runZero
  6. May 2026 Cisco Catalyst SD-WAN vulnerability: CVE-2026-20182
  7. March 2026 Cisco Catalyst SD-WAN vulnerability: CVE-2026-20127

How to find Cisco Catalyst SD-WAN installations on your network

Matthew Kienow
runZero Team
Cale Black
|
Updated

Critical Cisco Catalyst SD-WAN vulnerability: CVE-2026-76504 #

Cisco disclosed certain versions of Cisco Catalyst SD-WAN Manager (formerly vManage) contain a vulnerability in the authentication verification mechanism. A remote, unauthenticated adversary could exploit this by sending crafted requests to an affected system to bypass authentication and obtain administrative privileges. The vulnerability has been designated CVE-2026-76504 and has been rated critical with a CVSS score of 9.8.

There is evidence that this vulnerability is being actively exploited in the wild.

    The following deployment environments are affected

    • On-Premise deployments

      The following versions are affected

      • Catalyst SD-WAN releases prior to 20.9
      • Catalyst SD-WAN release 20.9 versions prior to 20.9.10.1
      • Catalyst SD-WAN release 20.12 versions prior to 20.12.8.2
      • Catalyst SD-WAN release 20.15 versions prior to 20.15.6.1
      • Catalyst SD-WAN release 20.18 versions prior to 20.18.4.1
      • Catalyst SD-WAN release 26.1 versions prior to 26.1.2.1
      • Catalyst SD-WAN release 26.2 versions prior to 26.2.1

      What is Cisco Catalyst SD-WAN Manager? #

      The Cisco Catalyst SD-WAN Manager acts as the centralized management system, providing the graphical interface necessary for the configuration, monitoring, and orchestration of all devices within the fabric.

      What is the impact? #

      Successful exploitation of the vulnerability would allow an attacker to bypass authentication checks and gain admin access to the administrative APIs.

      Are updates or workarounds available? #

      Users are encouraged to update to the latest version as quickly as possible:

      • Catalyst SD-WAN releases prior to 20.9 migrate to a fixed release.
      • Catalyst SD-WAN release 20.9 upgrade to version 20.9.10.1 and later.
      • Catalyst SD-WAN release 20.12 upgrade to version 20.12.8.2 and later.
      • Catalyst SD-WAN release 20.15 upgrade to version 20.15.6.1 and later.
      • Catalyst SD-WAN release 20.18 upgrade to version 20.18.4.1 and later.
      • Catalyst SD-WAN release 26.1 upgrade to version to 26.1.2.1 and later.
      • Catalyst SD-WAN release 26.2 upgrade to version 26.2.1 and later.

      Finding exposed systems with runZero #

      From the Asset Inventory, use the following query to locate potentially impacted assets:

      hw:="Cisco vManage" OR os:="Cisco Viptela OS"

      May 2026 Cisco Catalyst SD-WAN vulnerability: CVE-2026-20182 #

      Cisco disclosed certain versions of Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage) contain a vulnerability in the peering authentication mechanism. A remote, unauthenticated adversary could exploit this by sending crafted requests to an affected system to bypass authentication and obtain administrative privileges. By leveraging an internal, high-privileged, non-root user account, the adversary could access NETCONF, enabling them to manipulate the network configuration for the entire SD-WAN fabric. The vulnerability has been designated CVE-2026-20182 and has been rated critical with a CVSS score of 10.0.

        There is evidence that this vulnerability is being actively exploited in the wild.

        The following deployment environments are affected

        • On-Premise deployments
        • Cisco Hosted SD-WAN Cloud (Standard, Cisco Managed, and FedRAMP)

          The following versions are affected

          • Catalyst SD-WAN releases prior to 20.9
          • Catalyst SD-WAN release 20.9 versions prior to 20.9.9.1
          • Catalyst SD-WAN release 20.10 versions prior to 20.12.7.1
          • Catalyst SD-WAN release 20.11 versions prior to 20.12.7.1
          • Catalyst SD-WAN release 20.12 versions prior to 20.12.5.4
          • Catalyst SD-WAN release 20.12 versions prior to 20.12.6.2
          • Catalyst SD-WAN release 20.13 versions prior to 20.12.7.1
          • Catalyst SD-WAN release 20.13 versions prior to 20.15.5.2
          • Catalyst SD-WAN release 20.14 versions prior to 20.15.5.2
          • Catalyst SD-WAN release 20.15 versions prior to 20.15.4.4
          • Catalyst SD-WAN release 20.15 versions prior to 20.15.5.2
          • Catalyst SD-WAN release 20.16 versions prior to 20.18.2.2
          • Catalyst SD-WAN release 20.18 versions prior to 20.18.2.2
          • Catalyst SD-WAN release 26.1 versions prior to 26.1.1.1

          What is the impact? #

          Successful exploitation of the vulnerability would allow an adversary to obtain administrative privileges manipulate the network configuration for the entire SD-WAN fabric.

          Are updates or workarounds available? #

          Users are encouraged to update to the latest version as quickly as possible:

          • Catalys SD-WAN releases prior to 20.9 migrate to a fixed release.
          • Catalyst SD-WAN release 20.9 upgrade to version 20.9.9.1 and later.
          • Catalyst SD-WAN release 20.10 upgrade to version 20.12.7.1 and later.
          • Catalyst SD-WAN release 20.11 upgrade to version 20.12.7.1 and later.
          • Catalyst SD-WAN release 20.12 upgrade to version 20.12.5.4 and later.
          • Catalyst SD-WAN release 20.12 upgrade to version 20.12.6.2 and later.
          • Catalyst SD-WAN release 20.13 upgrade to version 20.12.7.1 and later.
          • Catalyst SD-WAN release 20.13 upgrade to version 20.15.5.2 and later.
          • Catalyst SD-WAN release 20.14 upgrade to version 20.15.5.2 and later.
          • Catalyst SD-WAN release 20.15 upgrade to version 20.15.4.4 and later.
          • Catalyst SD-WAN release 20.15 upgrade to version 20.15.5.2 and later.
          • Catalyst SD-WAN release 20.16 upgrade to version 20.18.2.2 and later.
          • Catalyst SD-WAN release 20.18 upgrade to version 20.18.2.2 and later.
          • Catalyst SD-WAN release 26.1 upgrade to version 26.1.1.1 and later.

          How to find potentially vulnerable systems with runZero #

          From the Asset Inventory, use the following query to locate potentially impacted assets:

          hw:="Cisco vManage" OR os:="Cisco Viptela OS"

          Note: The query locates Cisco Catalyst SD-WAN Manager installations.

          March 2026 Cisco Catalyst SD-WAN vulnerability: CVE-2026-20127 #

          Cisco disclosed certain versions of Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage) contain a vulnerability in the peering authentication mechanism. A remote, unauthenticated adversary could exploit this by sending crafted requests to an affected system to bypass authentication and obtain administrative privileges. By leveraging an internal, high-privileged, non-root user account, the adversary could access NETCONF, enabling them to manipulate the network configuration for the entire SD-WAN fabric. The vulnerability has been designated CVE-2026-20127 and has been rated critical with a CVSS score of 10.0.

            There is evidence that this vulnerability is being actively exploited in the wild.

            On March 11, 2026, CISA published V1: ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems. This version supersedes the actions outlined in the original February 25 directive, introducing updated remediation steps and new reporting requirements for affected organizations.

            The following deployment environments are affected

            • On-Premise deployments
            • Cisco Hosted SD-WAN Cloud (Standard, Cisco Managed, and FedRAMP)

              The following versions are affected

              • Catalyst SD-WAN releases prior to 20.9
              • Catalyst SD-WAN release 20.9 versions prior to 20.9.8.2
              • Catalyst SD-WAN release 20.11 versions prior to 20.12.6.1
              • Catalyst SD-WAN release 20.12.5 versions prior to 20.12.5.3
              • Catalyst SD-WAN release 20.12.6 versions prior to 20.12.6.1
              • Catalyst SD-WAN release 20.13 versions prior to 20.15.4.2
              • Catalyst SD-WAN release 20.14 versions prior to 20.15.4.2
              • Catalyst SD-WAN release 20.15 versions prior to 20.15.4.2
              • Catalyst SD-WAN release 20.16 versions prior to 20.18.2.1
              • Catalyst SD-WAN release 20.18 versions prior to 20.18.2.1

              What is the impact? #

              Successful exploitation of the vulnerability would allow an adversary to obtain administrative privileges manipulate the network configuration for the entire SD-WAN fabric.

              Are updates or workarounds available? #

              Users are encouraged to update to the latest version as quickly as possible:

              • Catalyst SD-WAN releases prior to 20.9 migrate to a fixed release
              • Catalyst SD-WAN release 20.9 upgrade to version 20.9.8.2 and later
              • Catalyst SD-WAN release 20.11 upgrade to version 20.12.6.1 and later
              • Catalyst SD-WAN release 20.12.5 upgrade to version 20.12.5.3 and later
              • Catalyst SD-WAN release 20.12.6 upgrade to version 20.12.6.1 and later
              • Catalyst SD-WAN release 20.13 upgrade to version 20.15.4.2 and later
              • Catalyst SD-WAN release 20.14 upgrade to version 20.15.4.2 and later
              • Catalyst SD-WAN release 20.14 upgrade to version 20.15.4.2 and later
              • Catalyst SD-WAN release 20.16 upgrade to version 20.18.2.1 and later
              • Catalyst SD-WAN release 20.18 upgrade to version 20.18.2.1 and later

              How to find potentially vulnerable systems with runZero #

              From the Asset Inventory, use the following query to locate potentially impacted assets:

              hw:="Cisco vManage" OR os:="Cisco Viptela OS"

              Note: The query locates Cisco Catalyst SD-WAN Manager installations.

              Written by Matthew Kienow

              Matthew Kienow is a software engineer and security researcher. Matthew previously worked on the Recog recognition framework, AttackerKB as well as Metasploit's MSF 5 APIs. He has also designed, built, and successfully deployed many secure software solutions; however, often he enjoys breaking them instead. He has presented his research at various security conferences including DerbyCon, Hack In Paris, and CarolinaCon. His research has been cited by CSO, Threatpost and SC Magazine.

              More about Matthew Kienow

              Written by runZero Team

              Great research and development is a team effort! Multiple runZero team members collaborated on this post. Go team!

              More about runZero Team

              Written by Cale Black

              Cale Black is a vulnerability researcher at runZero. Previously Cale worked as a lead penetration tester and researcher where he reproduced and delivered over 200 N-day exploits, and developed for the go-exploit exploitation framework.

              More about Cale Black
              Subscribe Now

              Get the latest news and expert insights delivered in your inbox.

              Welcome to the club! Your subscription to our newsletter is successful.

              Explore more runZero

              Product
              runZero 5.1 is here: Secure AI workflows, enhanced integrations, and expanded autonomous discovery
              runZero 5.1 takes on the heavy lifting across five key areas, enabling you to unmask and remediate exposures with less friction and more speed.
              Read More
              Podcasts
              Know Your Adversary with HD Moore
              runZero CEO HD Moore breaks down the myth of air-gapped networks, the impact of AI on security, and why asset connectivity is everything.
              Watch Now
              runZero Perspective
              BOD 26-04: A new era of prioritized remediation
              A complete breakdown of CISA's BOD 26-04 directive. Learn how the shift to SSVC, risk-based KEV prioritization, and 3-day remediation impacts your...
              Read More
              runZero Perspective
              Dawn of the apex agentic adversary
              When agentic AI can weaponize exploits in seconds, visibility is everything. Stop the predator with runZero’s exposure management for the AI-attack...
              Read More
              Podcasts
              Risky Biz: HD Moore talks OT security, frontier fearmongering and more
              Patrick Gray chats with industry legend HD Moore about how his company runZero wound up being used heavily to discover OT devices in enterprise...
              Watch Now
              Webcasts
              runZero Hour, Ep. 34: Vulnerability vibes: Disclosures, meetups, and the AI evolution
              Watch the runZero Hour replay: separating AI "slop" from real vulnerability insights, running local hacker meetups, and analyzing the top monthly...
              Watch Now
              Product Videos
              Custom integrations at AI speed
              Build custom exposure management integrations on your terms. runZero 5.1 lets you leverage your choice of AI to create, adapt, and secure your...
              Watch Now
              Webcasts
              runZero Hour, Ep. 33: Hacker Summer Camp: we survived the Vegas heat (and the bugs)
              In this post-Hacker Summer Camp recap, the runZero team break down the research, tools, and trends discussed at BSides Las Vegas, Black Hat and DEF...
              Watch Now

              See Results in Minutes

              See & secure your total attack surface. Even the unknowns & unmanageable.

              Try runZero for Free
              runZero CAASM
              © Copyright 2026 runZero, Inc. All Rights Reserved