Emergency Directive ED 26-03

Emergency Directive ED 26-03 is the CISA emergency directive issued on 14 May 2026 in response to active exploitation of Cisco SD-WAN CVE-2026-20182 (CVSS 10.0) by threat actor UAT-8616. Emergency Directives are issued under the authority of CISA's parent legislation and sit above Binding Operational Directive 22-01 in urgency, compressing the standard KEV remediation window from fourteen days to three days, with a federal deadline of 17 May 2026. The directive required all US federal civilian executive branch agencies to either apply available mitigations or isolate affected Cisco Catalyst SD-WAN Manager and Controller deployments.

ED 26-03 is the sixth Cisco SD-WAN CVE requiring urgent federal action in 2026. The vulnerability in question, an authentication bypass in the vdaemon service over DTLS port 12346, received the maximum CVSS 10.0 score. UAT-8616's post-compromise activity on confirmed victims included SSH key injection, NETCONF configuration manipulation, account creation, and log clearing, tradecraft consistent with establishing durable network-edge persistence. The directive's three-day window reflects CISA's assessment that UAT-8616 was actively exploiting federal civilian networks at the time of issuance.

The directive was issued the same week that UNC6780 was named as the operator behind the theft of Cisco AI Defense source code, placing two distinct adversary campaigns against the same vendor's portfolio inside a single reporting window. The juxtaposition raised the question, which Cisco has not publicly answered, of whether UNC6780's source-code visibility accelerates the next SD-WAN exploit cycle beyond the six CVEs already catalogued in 2026.