GoKawiilA highly sophisticated threat actor is exploiting a critical vulnerability in Cisco Catalyst Software-Defined Wide Area Network (SD-WAN) Controllers.
Rapid7 disclosed CVE-2026-20182, an authentication bypass vulnerability in Cisco's market-leading network management solution. By allowing unauthenticated attackers free rein over one of an organization's most powerful tools, it earned the highest possible 10 out of 10 score in the Common Vulnerability Scoring System (CVSS).
In an updated blog post today, Rapid7 director of vulnerability intelligence Douglas McKee hammered home just how serious an issue this was. "Attackers have become very good at turning central infrastructure weaknesses into high impact operations," he warned, and for nation-states in particular, "an SD-WAN controller is a great place to do [espionage], because it lives in the middle of trust relationships most organizations rarely question." To avoid sensationalizing, McKee added, "To be fair, not every bug turns into Internet-wide exploitation overnight."
Related:'Dirty Frag' Exploit Poised to Blow Up on Enterprise Linux Distros
In fact, CVE-2026-20182 had been exploited overnight. In a separate publication that same day, researchers at Cisco Talos flagged that a group it tracks as UAT-8616 has already gotten to it.
Hackers Leverage Critical Bugs in Cisco Catalyst
Not only is CVE-2026-20182 not the first vulnerability discovered in Cisco Catalyst this year, it isn't even the first authentication bypass vulnerability with a "critical" 10 score on the CVSS scale.
Back in February, Cisco revealed half a dozen issues with Catalyst. The cream was CVE-2026-20127, which gave unauthenticated attackers the power to log into Cisco controllers as high-privileged users. Though Cisco characterized in-the-wild exploitation of CVE-2026-20127 as "limited," Talos researchers suggested that it was extensive, lasting at least a few years — a lifetime in cyber years. They labeled the threat cluster actor behind that exploitation "UAT-8616," calling it "highly sophisticated."
Cisco patched CVE-2026-20127, threatening to derail UAT-8616's fun. The threat actor was unphased, though, as it seems to have almost immediately picked up with yet another, nearly identical vulnerability in the very same product line.
The difference is really only a technicality. In February, the issue was that the Catalyst Controller and Manager weren't rigorous enough in authenticating SD-WAN components, so any hacker off the street could use a specially crafted message to impersonate a device and get in. This month, the problem is that the Controller doesn't actually verify the legitimacy of a specific type of component — a hub router, "vHub," used in cloud deployments — before authenticating it. As a consequence, and as with the February CVE before it, attackers can use this new CVE to obtain administrative privileges in targeted systems and access "NETCONF," a protocol through which they could mess with all kinds of network configurations.
... continue reading