Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
1 IOC

CVE-2026-20182: Critical Authentication Bypass in Cisco SD-WAN Can Grant Admin Access

SOC Prime
SOC Prime
Published May 15, 2026Original Report

Malware Families

Excerpt

A vulnerability affecting Cisco Catalyst SD-WAN Controller has drawn urgent attention after Cisco, Rapid7, and CISA confirmed active exploitation. CVE-2026-20182 is a critical authentication bypass flaw in Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager that carries a CVSS 10.0 score and can let an unauthenticated remote attacker gain administrative privileges on an affected system. Cisco says the flaw stems from peering authentication in the control…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREunknownCAPABILITYMetasploitVICTIMunknown
Adversary
Infrastructure
Capability(1)
Victim

Attack Flow6 steps · MITRE ATT&CK mapped

Initial AccessTA0001T1190
1/6
Exploit Public-Facing Application
ActionBypass authentication
An unauthenticated remote attacker exploits CVE-2026-20182, an authentication bypass flaw in Cisco SD-WAN Controller.

Indicators of Compromise

Open the mindmap →

1 indicators

TypeIndicatorConfidenceScoreFirst Seen
CVECVE-2026-20182HighScore 77/100First seen

IOC Relationship Graph

Building graph…