The Cybersecurity and Infrastructure Security Agency (CISA), the US federal civilian cyber-defence authority inside the Department of Homeland Security, added Cisco SD-WAN CVE-2026-20182 to its Known Exploited Vulnerabilities (KEV) catalogue on Thursday 14 May 2026 and issued Emergency Directive ED 26-03 with a three-day federal remediation window expiring Sunday 17 May. The vulnerability scores CVSS 10.0, the maximum severity on the Common Vulnerability Scoring System12.
The vulnerable surface is the vdaemon service on Catalyst SD-WAN Manager and Controller, listening on DTLS port 12346. UAT-8616, the cluster CISA confirmed exploiting the flaw, conducted SSH key injection, NETCONF configuration manipulation, account creation, and log clearing once inside. Per CISA's advisory, UAT-8616's Operational Relay Box infrastructure overlaps with Flax Typhoon and Integrity Technology Group networks named in the sixteen-agency joint advisory published on 23 April 2026. Integrity Technology Group, the Beijing firm sanctioned by the US Office of Foreign Assets Control in December 2025, remains formally identified as the infrastructure operator behind Flax Typhoon's covert proxy estate.
This is the sixth Cisco SD-WAN CVE catalogued and exploited in 2026, following three earlier SD-WAN Manager CVEs added on 20 April with the shortest federal deadline of that window. The sustained operational tempo against one product family is a continuation of the FIRESTARTER edge-device exposure documented by CISA and the UK NCSC on 24 April, where UAT-4356 deployed a backdoor on the vendor's firewall estate that persisted through every patch and firmware update. For network defenders, two adversary clusters are now demonstrably present inside the same vendor's edge estate within a fortnight.
