Cisco SD-WAN Authenticated Privilege Escalation Vulnerability Advisory (CVE-2026-20182/20127)

Vulnerability Overview Vulnerability Name: Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability Vulnerability ID: cisco-sa-sdwan-privesc-4uxfRdtx CVE Numbers: CVE-2026-20182, CVE-2026-20127 CVSS Score: Base 7.8 Severity: High Release Date: April 22, 2026 Last Update Date: June 12, 2026 Version: 1.8 Status: Final Description: This vulnerability allows an authenticated local attacker to execute arbitrary commands as the root user by providing a crafted file to the affected system. The vulnerability exists due to insufficient validation of user-supplied input. An attacker can exploit this vulnerability by uploading a crafted file to the affected system, thereby executing a command injection attack and escalating their privileges to the root user. Affected Products Affected Products: - Cisco Catalyst SD-WAN Controller - Cisco Catalyst SD-WAN Manager - Cisco Catalyst SD-WAN Validator Affected Deployment Types: - On-Prem Deployment - Cisco SD-WAN Cloud-Pro - Cisco SD-WAN Cloud (Cisco Managed) - Cisco SD-WAN for Government (FedRAMP) Affected Software Versions: - 20.9.1 and earlier - 20.12.7.1 and earlier - 20.15.4.4 and earlier - 20.15.5.2 and earlier - 20.18.3 - 26.1.1.1 and earlier Remediation Recommended Actions: - Upgrade to the fixed software version documented below. - Before upgrading, issue the command on each control component in the SD-WAN deployment to preserve potential indicators of compromise (IOCs). - Check logs to confirm whether the system has been compromised. Fixed Software Versions: - 20.9.2 - 20.12.7.2 - 20.15.4.5 - 20.15.5.3 - 20.18.3.1 - 26.1.1.2 Proof of Concept No specific POC or exploit code was provided on the page. Additional Information Workarounds: There are no workarounds for this vulnerability. Indicators of Compromise (IOCs): - Check the file in the directory for specific log entries. - Example log entries: Source: - Thanks to Chester Sng, Pete Boonyakarn, and Logeswaran Nadarajan of Mandiant, a division of Google Cloud, for reporting this vulnerability. URL: - Cisco Security Advisory Revision History: - Version 1.8: Updated the fixed release table to include 20.9.2 and 20.12.7.2, and changed the status from Interim to Final. - Version 1.7: Updated the fixed release table to include 20.15.4 and 20.15.5.3. --- The above is a summary of the key information regarding the vulnerability extracted from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco SD-WAN Authenticated Privilege Escalation Vulnerability Advisory (CVE-2026-20182/20127)