---
schema: 1
kind: threat
title: "UAT-8616 exploits Cisco Catalyst SD-WAN CVE-2026-20182; 10+ clusters exploit companion February 2026 CVEs; CISA Emergency Directive ED-26-03 issued"
headline: "UAT-8616 exploits Cisco Catalyst SD-WAN CVE-2026-20182; 10+ clusters exploit companion February 2026 CVEs; CISA Emergency Directive ED-26-03 issued"
summary: "Cisco Talos published an updated exploitation bulletin on 2026-05-14 documenting active, in-the-wild exploitation of CVE-2026-20182 — a complete pre-authentication bypass in the Cisco Catalyst SD-WAN Controller — by UAT-8616, a highly sophisticated actor assessed to have operated against Cisco SD-WAN infrastructure …"
discovered_at: "2026-05-15T05:00:00Z"
event_date: 2026-05-14
run_id: 2026-05-15-58b94fbd
priority: notable
immediate_action: null
tags:
  - actively-exploited
  - pre-auth
  - rce
  - nation-state
  - cisa-kev
regions:
  - global
sectors:
  - telco
  - public-sector
  - energy
entities:
  - "actor:uat-8616"
cves: []
sources:
  - url: "https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/"
    publisher: "Cisco Talos, 2026-05-14"
    role: primary
  - url: "https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/"
    publisher: "Rapid7, 2026-05-14"
    role: corroborating
  - url: "https://www.securityweek.com/cisco-patches-another-sd-wan-zero-day-the-sixth-exploited-in-2026/"
    publisher: "SecurityWeek, 2026-05-15"
    role: corroborating
closed_sources: []
evidence: []
verification: multi-source
sourcing_note: null
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
watchlist_hit: false
actions:
  - "**Emergency upgrade Cisco Catalyst SD-WAN Controller and Manager** to a fixed release (20.9.9.1 / 20.12.7.1 / 20.15.5.2 / 20.18.2.2 / 26.1.1.1 per your release train) — CVE-2026-20182 (CVSS 10.0) has no workaround and is actively exploited by UAT-8616; companion February 2026 CVEs are being exploited by 10+ additional clusters on the same infrastructure. If immediate upgrade is not possible, apply an ACL restricting access to UDP/12346 to known device IPs as a temporary partial control."
migrated_from: briefs/2026-05-15.md
---

Cisco Talos published an updated exploitation bulletin on 2026-05-14 documenting active, in-the-wild exploitation of CVE-2026-20182 — a complete pre-authentication bypass in the Cisco Catalyst SD-WAN Controller — by UAT-8616, a highly sophisticated actor assessed to have operated against Cisco SD-WAN infrastructure since at least 2023 with ORB-network-hosted tooling ([Cisco Talos, 2026-05-14](https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/)). Separately, at least 10 additional less-sophisticated threat clusters (Cluster #1 through #10 in Talos's taxonomy) have been exploiting the companion February 2026 CVEs (CVE-2026-20133, CVE-2026-20128, CVE-2026-20122) since March 2026 ([Rapid7, 2026-05-14](https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/)). Post-exploitation activity includes deployment of Godzilla, Behinder, and XenShell webshells; AdaptixC2, Sliver, and Nimplant C2 frameworks; XMRig cryptomining; and log-wiping to remove `syslog`, `wtmp`, and `lastlog` artefacts. UAT-8616 additionally performs a targeted version-downgrade to re-expose CVE-2022-20775 (local privilege escalation to root), then restores the original version to erase the downgrade trace. CISA issued Emergency Directive ED-26-03 on 2026-05-14 designating this the sixth Cisco SD-WAN CVE exploited in 2026; companion CVEs CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 were being exploited by multiple clusters since March 2026. Snort detection signatures: 66482–66483 (CVE-2026-20182), 66468–66469 (CVE-2026-20133), 66461–66462 (CVE-2026-20122). Hunt: look for unexpected NETCONF sessions on TCP/830 from Controller processes; additions to `/home/vmanage-admin/.ssh/authorized_keys`; out-of-sequence software downgrade/upgrade log events in vManage; and peer registrations from unknown ASNs in `show sdwan control connections`.