Skip to content
Sign in

Cisco product

Catalyst SD-WAN

Alert
No CISA KEV deadline is open. CISA last added a Catalyst SD-WAN CVE on 14 May.

Tracked since 14 May · latest article 30 Sep · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 1 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date1

Catalyst SD-WAN CVEs in CISA KEV with their federal deadlines. None is open.

Exploited Catalyst SD-WAN CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2026-20182Catalyst SD-WAN14 MayPassed 17 May10
Vendor CSV of 101 entries for CiscoAll 101 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds Catalyst SD-WAN CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’250Q1 ’261Q2 ’260Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20261
Q3 20260
Q4 20260

Fix listed

1 of 1 CVE in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-20182: 99.8th percentile, in CISA KEV050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-2018299.8

Coverage10 articles · all time

The latest 10 articles naming Catalyst SD-WAN, in the shared story grammar.

Full timeline
Quiet for 4 weekslast report 30 Sep10 articles7 outlets

10 articles from 7 outlets since 14 May. Quiet since 30 Sep.

Now14 May2029 Sep35791215182124First reportCISA · 14 May, 17:51Picked up againafter 3 days quiet
  • Thu 14 May, 17:51 UTC. CISA, first report. CVE-2026-20182 Flaw in Cisco SDWAN Lets. Cites a CVE in CISA KEV.
  • Thu 14 May, 18:11 UTC. CISA. Cisco SD WAN authentication bypass lets attackers gain admin access. Cites a CVE in CISA KEV.
  • Thu 14 May, 19:11 UTC. The Hacker News, its first report on the story. Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access. Cites a CVE in CISA KEV.
  • Thu 14 May, 19:41 UTC. Security Affairs, its first report on the story. U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Thu 14 May, 20:51 UTC. Dark Reading, its first report on the story. Cisco SD WAN flaw lets attackers seize control, patch urged. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:11 UTC. The Hacker News. CISA warns of Cisco Catalyst SDWAN flaw amid active exploitation. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:41 UTC. SecurityWeek, its first report on the story. Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT8616. Cites a CVE in CISA KEV.
  • Fri 15 May, 12:11 UTC. SOCRadar, its first report on the story. CVE-2026-20182 Cisco SD WAN flaw grants remote admin access. Cites a CVE in CISA KEV.
  • Mon 18 May, 15:42 UTC. The Hacker News. Microsoft Exchange zero day bug exploited in the wild. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 18:38 UTC. Rapid7, its first report on the story. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 10 articles as a list
  1. Thu 14 MayDay 05
    1. CVE-2026-20182 Flaw in Cisco SDWAN Lets17:51 · CISA · official · First report · CISA alert · Known exploited CVE
    2. Cisco SD WAN authentication bypass lets attackers gain admin access18:11 · CISA · official · Known exploited CVE
    3. Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access19:11 · The Hacker News · Known exploited CVE
    Show 2 more from 14 May
    1. U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog19:41 · Security Affairs · Known exploited CVE
    2. Cisco SD WAN flaw lets attackers seize control, patch urged20:51 · Dark Reading · Known exploited CVE
  2. Fri 15 MayDay 13
    1. CISA warns of Cisco Catalyst SDWAN flaw amid active exploitation06:11 · The Hacker News · Known exploited CVE
    2. Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT861606:41 · SecurityWeek · Known exploited CVE
    3. CVE-2026-20182 Cisco SD WAN flaw grants remote admin access12:11 · SOCRadar · Known exploited CVE

  3. Quiet for 3 days

    Mon 18 MayDay 41
    1. Microsoft Exchange zero day bug exploited in the wild15:42 · The Hacker News · Picked up again · Known exploited CVE

  4. Quiet for 19 weeks

    Wed 30 SepDay 1391
    1. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access18:38 · Rapid7 · Picked up again · Known exploited CVE

All CVEs in coverage1

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-20182Exploited

    Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

    10.0Critical92% EPSS · 10 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in