Multiple critical authentication bypass vulnerabilities in Cisco Catalyst SD-WAN Controller and Manager are under active exploitation. A sophisticated threat actor tracked as UAT-8616 has been exploiting these systems since at least 2023, and 10 additional threat clusters began exploiting a chain of vulnerabilities in March 2026 after proof-of-concept code was published. CISA issued Emergency Directive 26-03 and added CVE-2026-20182 to the KEV catalog on May 14 with a 3-day remediation deadline.

For more information about the vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.