{"schema":"vulnpedia.research/1","cve":"CVE-2026-20182","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW","tags":["Vendor Advisory","KEV report"],"source":"mitre","sourceId":"cisco","modified":"2026-06-16T17:57:59.048Z","origins":[{"source":"mitre","sourceId":"cisco","modified":"2026-06-16T17:57:59.048Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW"},{"source":"nvd","sourceId":"CVE-2026-20182","modified":"2026-06-17T15:06:02.767","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW"},{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","modified":"2026-05-14T00:00:00Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW"}]},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk","tags":["Not Applicable"],"source":"mitre","sourceId":"cisco","modified":"2026-06-16T17:57:59.048Z","origins":[{"source":"mitre","sourceId":"cisco","modified":"2026-06-16T17:57:59.048Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"},{"source":"nvd","sourceId":"CVE-2026-20182","modified":"2026-06-17T15:06:02.767","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-05-15T03:56:08.320Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-05-15T03:56:08.320Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182"},{"source":"nvd","sourceId":"CVE-2026-20182","modified":"2026-06-17T15:06:02.767","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182"}]},{"source":"euvd","sourceId":"EUVD-2026-30324","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30324","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-30324","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30324"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-20182","modified":"2026-05-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","modified":"2026-05-14T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-20182","modified":"2026-05-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","modified":"2026-05-14T00:00:00Z","url":"https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-20182","modified":"2026-05-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","modified":"2026-05-14T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://x.com/stephenfewer/status/2054959580333965761?s=20","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-20182","modified":"2026-05-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","modified":"2026-05-14T00:00:00Z","url":"https://x.com/stephenfewer/status/2054959580333965761?s=20"}]},{"url":"https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-20182","modified":"2026-05-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","modified":"2026-05-14T00:00:00Z","url":"https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild"}]},{"url":"https://vulncheck.com/xdb/28e74be1e915","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"28e74be1e915","modified":"2026-05-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"28e74be1e915","modified":"2026-05-14T00:00:00Z","url":"https://vulncheck.com/xdb/28e74be1e915"}]},{"url":"https://github.com/Nxploited/CVE-2026-20182","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"28e74be1e915","modified":"2026-05-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"28e74be1e915","modified":"2026-05-14T00:00:00Z","url":"https://github.com/Nxploited/CVE-2026-20182"}]},{"url":"https://vulncheck.com/xdb/1046bd06c72e","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"1046bd06c72e","modified":"2026-05-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"1046bd06c72e","modified":"2026-05-14T00:00:00Z","url":"https://vulncheck.com/xdb/1046bd06c72e"}]},{"url":"https://github.com/HORKimhab/CVE-2026-20182","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"1046bd06c72e","modified":"2026-05-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"1046bd06c72e","modified":"2026-05-14T00:00:00Z","url":"https://github.com/HORKimhab/CVE-2026-20182"}]},{"url":"https://vulncheck.com/xdb/a91de5bfcbd7","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"a91de5bfcbd7","modified":"2026-05-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"a91de5bfcbd7","modified":"2026-05-14T00:00:00Z","url":"https://vulncheck.com/xdb/a91de5bfcbd7"}]},{"url":"https://github.com/portbuster1337/CVE-2026-20182","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"a91de5bfcbd7","modified":"2026-05-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"a91de5bfcbd7","modified":"2026-05-14T00:00:00Z","url":"https://github.com/portbuster1337/CVE-2026-20182"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/portbuster1337/CVE-2026-20182","source":"poc-in-github","sourceId":"CVE-2026-20182","description":"CVE-2026-20182 PoC - Cisco Catalyst SD-WAN Controller / Manager Authentication Bypass (CVSS 10.0)","modified":"2026-06-11T08:09:08Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-20182","url":"https://github.com/portbuster1337/CVE-2026-20182"},{"source":"poc-in-github","sourceId":"CVE-2026-20182","modified":"2026-06-11T08:09:08Z","url":"https://github.com/portbuster1337/CVE-2026-20182"}],"tags":[]},{"url":"https://github.com/HORKimhab/CVE-2026-20182","source":"poc-in-github","sourceId":"CVE-2026-20182","description":"CVE-2026-20182","modified":"2026-05-24T06:46:05Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-20182","url":"https://github.com/HORKimhab/CVE-2026-20182"},{"source":"poc-in-github","sourceId":"CVE-2026-20182","modified":"2026-05-24T06:46:05Z","url":"https://github.com/HORKimhab/CVE-2026-20182"}],"tags":[]},{"url":"https://github.com/Nxploited/CVE-2026-20182","source":"poc-in-github","sourceId":"CVE-2026-20182","description":"Cisco Catalyst SD-WAN Peering Authentication Bypass","modified":"2026-05-28T07:23:50Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-20182","url":"https://github.com/Nxploited/CVE-2026-20182"},{"source":"poc-in-github","sourceId":"CVE-2026-20182","modified":"2026-05-28T07:23:50Z","url":"https://github.com/Nxploited/CVE-2026-20182"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"28e74be1e915","url":"https://vulncheck.com/xdb/28e74be1e915","cve":"CVE-2026-20182","dateAdded":"2026-05-26T21:49:42Z","modified":"2026-05-14T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/Nxploited/CVE-2026-20182","observations":[{"dateAdded":"2026-05-26T21:49:42Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"28e74be1e915","modified":"2026-05-14T00:00:00Z","url":"https://vulncheck.com/xdb/28e74be1e915"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"1046bd06c72e","url":"https://vulncheck.com/xdb/1046bd06c72e","cve":"CVE-2026-20182","dateAdded":"2026-06-02T19:54:26Z","modified":"2026-05-14T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/HORKimhab/CVE-2026-20182","observations":[{"dateAdded":"2026-06-02T19:54:26Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"1046bd06c72e","modified":"2026-05-14T00:00:00Z","url":"https://vulncheck.com/xdb/1046bd06c72e"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"a91de5bfcbd7","url":"https://vulncheck.com/xdb/a91de5bfcbd7","cve":"CVE-2026-20182","dateAdded":"2026-06-04T21:04:50Z","modified":"2026-05-14T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/portbuster1337/CVE-2026-20182","observations":[{"dateAdded":"2026-06-04T21:04:50Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"a91de5bfcbd7","modified":"2026-05-14T00:00:00Z","url":"https://vulncheck.com/xdb/a91de5bfcbd7"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-05-14T00:00:00Z","modified":"2026-05-14T00:00:00Z","requiredAction":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Cisco","product":"Catalyst SD-WAN","dueDate":"2026-05-17T00:00:00Z","cisaDateAdded":"2026-05-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","modified":"2026-05-14T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","catalog":"VulnCheck KEV","kind":"report","url":"https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/","dateAdded":"2026-05-14T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","url":"https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW"},{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","url":"https://x.com/stephenfewer/status/2054959580333965761?s=20"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","catalog":"VulnCheck KEV","kind":"report","url":"https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild","dateAdded":"2026-05-27T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20182","url":"https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild"}]}]}