Executive Summary
CVE-2026-20182 is a critical vulnerability (CVSS 10.0) in the Cisco Catalyst SD-WAN vdaemon service that allows remote, unauthenticated attackers to bypass authentication and become trusted control-plane peers. The flaw resides in the vbond_proc_challenge_ack() function, where peers claiming to be a vHub (device_type 2) skip all certificate and trust verification logic. This allows an attacker to establish a DTLS session using any certificate and successfully join the SD-WAN fabric.
Once authenticated, attackers can exploit high-privileged internal message handlers to manipulate routing policies, redirect network traffic, or maintain persistence by injecting SSH keys into the vmanage-admin account. Because these controllers act as the 'brain' of the enterprise network, successful exploitation can lead to a full compromise of the entire SD-WAN infrastructure. Cisco has released updates, and immediate patching is recommended as there are no configuration-based workarounds.