Last Updated: 2026-05-15T18:08:25Z
What’s Happening
CVE-2026-20182 Authentication Bypass in Cisco Catalyst SD-WAN controller has been found exploited in the wild. It has a severity rating of 10.
Rapid 7, who initially disclosed the vulnerability, has published their own in-depth analysis and timeline.
Rapid7 has also released a Metasploit Module that exploits this vulnerability.
Cisco has released an update and disclosed a number of IOC’s related to the ongoing exploitation.
The NIST CVE entry.
Actions
Update Cisco SD-WAN. This table from Rapid7 shows patched versions for all fixed releases:
| Cisco Catalyst SD-WAN Release | First Fixed Release |
|---|---|
| Earlier than 20.9* | Migrate to a fixed release |
| 20.9 | 20.9.9.1 |
| 20.10 | 20.12.7.1 |
| 20.11* | 20.12.7.1 |
| 20.12 | 20.12.5.4, 20.12.6.2, 20.12.7.1 |
| 20.13* | 20.15.5.2 |
| 20.14* | 20.15.5.2 |
| 20.15 | 20.15.4.4, 20.15.5.2 |
| 20.16* | 20.18.2.2 |
| 20.18 | 20.18.2.2 |
| 26.1.1 | 26.1.1.1 |
Indicators of Compromise
Note that the Cisco Talos IoCs listed in their linked GitHub repo appear to be for a different campaign.
| Value | Type | Description |
|---|---|---|
| 38.181.52[.]89 | IPv4 | Cluster 1 |
| 89.125.244[.]33 | IPv4 | Cluster 1 |
| 89.125.244[.]51 | IPv4 | Cluster 1 |
| 71.80.85[.]135 | IPv4 | Cluster 2 |
| 212.83.162[.]37 | IPv4 | Cluster 3 |
| 38.60.214[.]92 | IPv4 | Cluster 4 |
| 65.20.67[.]134 | IPv4 | Cluster 4 |
| 104.233.156[.]1 | IPv4 | Cluster 4 |
| 194.233.100[.]40 | IPv4 | Cluster 4 |
| f6f8e0d790645395188fc521039385b7c4f42fa8b426fd035f489f6cda9b5da1 | sha256 | Cluster 5 – AdaptixC2 sample |
| 194.163.175[.]135:4445 | IPv4:port | Cluster 5 – AdaptixC2 C2 server |
| 194.163.175[.]135 | IPv4 | Cluster 5 – AdaptixC2 C2 IP |
| 02654acfb21f83485393ba8b14bd8862b919b9ec966fc6768f6aac1338a45ee8 | sha256 | Cluster 6 – Sliver sample |
| mtls://23.27.143[.]170:443 | url | Cluster 6 – Sliver C2 over mTLS |
| 23.27.143[.]170 | IPv4 | Cluster 6 – Sliver C2 IP |
| 0ed72d52347bfe4a78afff8a6982a64050c8fc86d8957a20eeb3e0f3f5342ed0 | sha256 | Cluster 7 – XMRig downloader script |
| 96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46 | sha256 | Cluster 7 – XMRig sample |
| 7aa88a64a527ade7d93c20faf23b54f2ee33ad9b1246cdc2f8ded2ab639affb1 | sha256 | Cluster 7 – XMRig configuration |
| 83.229.126[.]195 | IPv4 | Cluster 7 – XMRig remote location IP |
| hxxp://83.229.126[.]195:8081/xmrig | url | Cluster 7 – XMRig remote URL |
| hxxp://83.229.126[.]195:8081/config.json | url | Cluster 7 – XMRig configuration file remote location |
| 0c87871642f84e09e8d3fb23ec36bf55601323e31151a7017a85dbec929cf15d | sha256 | Cluster 8 – Nim-based backdoor |
| hxxps://1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit[.]dev/download | url | Cluster 8 – Download URL for the Nim-based backdoor |
| 1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit.dev | hostname | Cluster 8 – Attacker controlled sub-domain hosting the Nim-based backdoor |
| 79.135.105[.]208 | IPv4 | Cluster 8 – Attacker IP that downloaded the Nim-based backdoor |
| hxxp://13[.]62[.]52[.]206:5004 | url | Cluster 8 – C2 for Nim-based backdoor |
| 13.62.52[.]206 | IPv4 | Cluster 8 – C2 IP for Nim-based backdoor |
| 18d77c9c5bbb5b9d5bdfd366fdfcf26bad9e64c63ca865fad711bcce8e3d5a80 | sha256 | Cluster 8 – KScan scanning tool |
| 176.65.139[.]31 | IPv4 | Cluster 8 – IP related to Nim-based backdoor and KScan |
| d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa | sha256 | Cluster 9 – gsocket sample |
| 5bc5998161056b7c8f70c9724d8a63abc7ff8c3843b91c30cffab0899e39b7f8 | sha256 | Cluster 9 – gsocket secret file |
| 47.104.248[.]7 | IPv4 | Cluster 9 – IP related to Miner activity |
| b0f51b098842cd630097b462aab0ec357e2c7824af37cca6d08165265da2c2d3 | sha256 | Cluster 10 – VManage credential extractor script |
| 72f570ce97de3eaaffef33d90b0c337a153fc9690cc34ee207b557d868360060 | sha256 | Cluster 10 – Check for root escalation |
| 17302d903baf182f94dc3be40ab1e0874dd0eb2ec5255bf9131fd53591efe925 | sha256 | Cluster 10 – Check for root escalation |