--- title: Critical Cisco SD-WAN Vulnerability Under Active Attack description: UAT-8616 is exploiting a maximum-severity authentication bypass in Cisco Catalyst SD-WAN (CVE-2026-20182). Cisco has patched, and CISA set a May 17 federal deadline. canonical_url: https://codekeeper.co/ticker/uat-8616-exploits-cisco-sd-wan-flaw --- # Critical Cisco SD-WAN Vulnerability Under Active Attack UAT-8616 is exploiting a maximum-severity authentication bypass in Cisco Catalyst SD-WAN (CVE-2026-20182). Cisco has patched, and CISA set a May 17 federal deadline. ![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png) By Content Team May 15, 2026 Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fuat-8616-exploits-cisco-sd-wan-flaw%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fuat-8616-exploits-cisco-sd-wan-flaw%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fuat-8616-exploits-cisco-sd-wan-flaw%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fuat-8616-exploits-cisco-sd-wan-flaw%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fuat-8616-exploits-cisco-sd-wan-flaw%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fuat-8616-exploits-cisco-sd-wan-flaw%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg) ON THIS PAGE ### Want more insights like this? Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox. By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) . A threat actor Cisco Talos tracks as UAT-8616 is exploiting a critical authentication bypass (CVE-2026-20182, CVSS 10.0) in Cisco Catalyst SD-WAN Controller and SD-WAN Manager — formerly vSmart and vManage. Talos says exploitation has been limited so far and clusters it under UAT-8616 with high confidence. Unauthenticated attackers gain administrative access and NETCONF control over network configuration. CISA added it to the KEV catalog the day it was disclosed and gave federal agencies until May 17 under Emergency Directive 26-03. Fixed releases are 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.12.7.1, 20.15.4.4, 20.15.5.2, 20.18.2.2 and 26.1.1.1 — check which train you're on, since older releases need migrating rather than updating. There's no workaround. It's at least the fifth Cisco SD-WAN flaw under active exploitation this year. UAT-8616 has been exploiting a nearly identical bypass, CVE-2026-20127, since at least 2023 — Cisco called that exploitation limited, Talos called it extensive. Ten further clusters, distinct from UAT-8616, have been hitting three more SD-WAN bypasses since March, dropping webshells, cryptominers and infostealers. UAT-8616 targets critical infrastructure and other high-value organizations globally, and reaches root by an unusual route: downgrade the software, exploit the old CVE-2022-20775, then restore the original version. Talos notes the group's infrastructure overlaps with Operational Relay Box networks it monitors. Check auth.log for "Accepted publickey for vmanage-admin" from unfamiliar IPs. _Updated August 13, 2026: Cisco patched another actively exploited SD-WAN Manager flaw in June — CVE-2026-20262, an arbitrary file write rated 6.5, KEV-listed with a June 29 federal deadline. Its fixed releases supersede the May builds: 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1 and 26.1.1.2. By then it was the eighth exploited Cisco SD-WAN flaw of 2026._ **Source:** [Dark Reading](https://www.darkreading.com/vulnerabilities-threats/maximum-severity-cisco-sd-wan-bug-exploited) Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fuat-8616-exploits-cisco-sd-wan-flaw%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fuat-8616-exploits-cisco-sd-wan-flaw%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fuat-8616-exploits-cisco-sd-wan-flaw%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fuat-8616-exploits-cisco-sd-wan-flaw%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fuat-8616-exploits-cisco-sd-wan-flaw%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fuat-8616-exploits-cisco-sd-wan-flaw%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg) ![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp) Have questions about protecting your software? Our escrow experts are standing by to help. [Book a free demo](https://codekeeper.co/book-a-demo) YOU MAY ALSO LIKE [Russian Hackers Are Still Exploiting a Year-Old WinRAR Flaw Against Ukraine Aug 12, 2026](https://codekeeper.co/ticker/russian-hackers-exploit-winrar-flaw) [Vulnerabilities Attackers Are Firing a Public Exploit at a Critical SharePoint Auth Bypass Aug 13, 2026](https://codekeeper.co/ticker/critical-sharepoint-vulnerability-cve-2026-55040) [Ransomware Attack Shuts Down Evanston Township High School Aug 12, 2026](https://codekeeper.co/ticker/ransomware-attack-evanston-high-closure) [INC Ransomware Gang Leads Attacks Exploiting Critical SonicWall Flaws Aug 11, 2026](https://codekeeper.co/ticker/inc-ransomware-sonicwall-vulnerabilities-exploitation)