Research · May 14, 2026 · ZeroDay Catalog
Cisco Catalyst SD-WAN Controller Vulnerability Exposes Authentication Bypass Risk
A newly identified vulnerability in Cisco's Catalyst SD-WAN Controller allows for potential authentication bypass, posing significant security risks.
What changed
A vulnerability has been identified in the Cisco Catalyst SD-WAN Controller that allows unauthenticated remote attackers to bypass authentication mechanisms. This issue was disclosed in February 2026, with a security advisory released in May 2026 detailing the vulnerability and providing guidance on remediation.
The vulnerability specifically affects the peering authentication process during control connection handshaking, which could lead to unauthorized access.
- The vulnerability was discovered in the control connection handshaking process.
- A security advisory has been issued with details and fix information.
- Show Control Connections guidance has been included to assist with system checks.
Who is affected
Organizations utilizing Cisco's SD-WAN products are at risk due to this vulnerability. The following products are specifically impacted:
Cisco Catalyst SD-WAN Controller, Cisco Catalyst SD-WAN Manager, and Cisco Catalyst SD-WAN Validator are all vulnerable to this authentication bypass issue.
- Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart)
- Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage)
- Cisco Catalyst SD-WAN Validator (formerly SD-WAN vBond)
- Any organization relying on these products for network management and security.
What to do
It is crucial for affected organizations to review the security advisory issued by Cisco and implement the recommended fixes promptly. Regular monitoring of control connections is advised to detect any unauthorized access attempts.
Utilizing the provided Show Control Connections guidance can help ensure that systems are secure and functioning as intended.
- Review the Cisco security advisory for detailed vulnerability information and fixes.
- Implement recommended patches and updates as soon as possible.
- Monitor control connections for any suspicious activity.
- Utilize the Show Control Connections guidance for system checks.