CVE-2026-20182: Inside the Cisco Catalyst SD-WAN CVSS 10.0 Auth Bypass & Metasploit PoC

A critical, maximum-severity vulnerability in the control connection handshake of the Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage) has drawn urgent global attention.[1, 2] Tracked as CVE-2026-20182 with a perfect CVSS 3.1 score of 10.0, the flaw represents a complete authentication bypass that allows unauthenticated, remote attackers to gain persistent administrative privileges over the affected system.[1, 3, 2]

Technical Analysis: The “vHub” Handshake Logic Bypass

The vulnerability exists within the vdaemon service, which operates over Datagram Transport Layer Security (DTLS) on UDP port 12346.[4, 3] This service manages critical routing control-plane components, such as the Overlay Management Protocol (OMP), TLOC tables, and routing fabric announcements.[4, 5]

When a control connection handshake is initiated, the controller transmits a 256-byte random challenge.[4] The connecting client must respond with a CHALLENGE_ACK message, which is processed by the internal function vbond_proc_challenge_ack().[4, 3] Inside this function, specific conditional blocks check the connecting peer’s claimed device type to enforce certificate checks [4]:

• If the client claims to be a **vSmart (type 3)** or **vManage (type 5)** device, the code executes strict certificate database lookups via is_serial_duplicate() and peer duplication checks via vbond_peer_dup_check().[4] This prevents unauthorized impersonation.[4]
• However, the conditional structures completely **omit** validation checks for **vHub (device type 2)** systems.[4, 3]

Because there is no conditional match or validation block written for device type 2, the execution flow falls through all security evaluations.[4] Consequently, an unauthenticated remote attacker can initiate a DTLS handshake using an arbitrary self-signed certificate, transmit a CHALLENGE_ACK claiming to be a vHub (type 2) device, and the controller will unconditionally set the peer->authenticated state to true.[4, 3]

From Handshake Bypass to Persistent RCE

Once established as an authenticated peer in the control plane, the attacker has access to post-authentication functionality.[1] Threat researchers Stephen Fewer and Jonah Burgess demonstrated that an attacker can exploit the MSG_VMANAGE_TO_PEER message handler to append an attacker-controlled SSH public key directly into the configuration path [3]:

By injecting a public key into the vmanage-admin account, the attacker converts a transient, memory-based DTLS handshake bypass into persistent, credential-independent administrative SSH access.[3] From there, they can connect to the NETCONF service over TCP port 830 and execute arbitrary administrative commands, completely compromising the routing orchestration of the entire corporate SD-WAN fabric.[1, 4, 3]

Calculating Risk: The Formula

To evaluate the direct threat vector within enterprise network boundaries, defenders should model the risk equation where vulnerability severity is scaled to its maximum exposure:

Given that the asset at risk is the central management platform managing the entire routing fabric (unquestioned central authority), the impact variable reaches maximum weight.[5]

Vulnerability Overview & Metasploit Integration

Following the public disclosure of the vulnerability, Rapid7 integrated a fully automated exploit module into the main branch of the Metasploit Framework (authored by developer jburgess-r7).[6] This means a highly reliable Proof of Concept (PoC) is now public and easily operationalized by threat actors.[1]

Detection & Remediation Guidance

Cisco has confirmed that no workarounds exist to mitigate this threat aside from applying the official software updates.[1] Security teams must prioritize the following actions:

1. Inventory and Update: Immediately inventory all Catalyst SD-WAN Controller and Manager nodes and upgrade to the vendor-patched releases.[1]
2. Audit Peering Logs: Review peering authentication events for unexpected device connections (specifically looking for anomalous device type 2 / vHub role assignments) or unfamiliar public IPs.[1]
3. Validate Authorized SSH Keys: Audit the authorized_keys directory of high-privilege administrative accounts, specifically vmanage-admin, to detect unauthorized SSH key injections.[1, 3]
4. Network Isolation: Restrict UDP port 12346 and TCP port 830 access only to known, verified infrastructure boundaries.[1, 5]