Cisco Catalyst SD-WAN Controller Authentication Bypass (CVE-2026-20182)

let sdwan_management_ports = dynamic([443, 8443, 8080, 8888, 830]);
let suspicious_paths = dynamic(["/dataservice", "/api/", "/j_security_check", "/login", "/management"]);
union
(
  CommonSecurityLog
  | where DeviceVendor has_any ("Cisco") and DeviceProduct has_any ("SD-WAN", "vManage", "vSmart", "vBond")
  | where Activity has_any ("auth_bypass", "authentication failure", "unauthorized", "401", "403")
  | extend SourceIP = coalesce(SourceIP, DeviceAddress)
),
(
  W3CIISLog
  | where csUriStem has_any (suspicious_paths)
  | where scStatus in (200, 302) and csMethod in ("GET", "POST")
  | where csUriQuery has_any ("token=", "jwt=", "session=")
),
(
  AzureNetworkAnalytics_CL
  | where DestPort_d in (sdwan_management_ports)
  | where FlowStatus_s == "A"
  | where FlowType_s == "ExternalPublic"
),
(
  DeviceNetworkEvents
  | where RemotePort in (sdwan_management_ports)
  | where InitiatingProcessFileName in~ ("curl.exe", "python.exe", "python3", "wget", "powershell.exe")
  | where RemoteUrl has_any ("vmanage", "sdwan", "catalyst-sdwan")
)
| summarize
    EventCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    UniqueSourceIPs = dcount(SourceIP)
  by bin(TimeGenerated, 5m), SourceIP, DestinationIP
| where EventCount > 5 or UniqueSourceIPs > 3
| extend
    Severity = "Critical",
    CVE = "CVE-2026-20182",
    Vendor = "Cisco",
    Product = "Catalyst SD-WAN"
| project TimeGenerated, SourceIP, DestinationIP, EventCount, UniqueSourceIPs, FirstSeen, LastSeen, Severity, CVE, Vendor, Product

index=network OR index=cisco OR index=firewall OR index=proxy
(
  (sourcetype="cisco:ios" OR sourcetype="cisco:sdwan" OR sourcetype="cisco:vmanage")
  (
    ("authentication bypass" OR "auth bypass" OR "unauthorized access" OR "CWE-287")
    OR ("vManage" AND ("401" OR "403" OR "login failed" OR "session invalid"))
    OR ("vSmart" AND ("unauthorized" OR "privilege escalation"))
    OR ("vBond" AND ("authentication" AND ("failed" OR "bypass" OR "invalid")))
  )
)
OR
(
  sourcetype="access_combined" OR sourcetype="apache:access"
  (uri_path="/dataservice*" OR uri_path="/api/*" OR uri_path="/j_security_check*")
  (status=200 OR status=302)
  NOT (src_ip="10.*" OR src_ip="172.16.*" OR src_ip="192.168.*")
)
OR
(
  sourcetype="cisco:asa" OR sourcetype="pan:traffic"
  (dest_port=443 OR dest_port=8443 OR dest_port=8080 OR dest_port=830)
  action=allowed
  (app="ssl" OR app="https")
)
| eval cve="CVE-2026-20182"
| eval vendor="Cisco"
| eval product="Catalyst SD-WAN"
| eval severity="critical"
| bucket _time span=5m
| stats
    count AS event_count,
    dc(src_ip) AS unique_src_ips,
    values(src_ip) AS source_ips,
    values(dest_ip) AS dest_ips,
    values(uri_path) AS accessed_paths,
    min(_time) AS first_seen,
    max(_time) AS last_seen
  BY _time, cve, vendor, product, severity
| where event_count > 5 OR unique_src_ips > 3
| sort -event_count

sequence by source.ip with maxspan=10m
  [
    network where
      destination.port in (443, 8443, 8080, 830, 8888) and
      (
        destination.domain like~ "*vmanage*" or
        destination.domain like~ "*sdwan*" or
        destination.domain like~ "*catalyst-sdwan*" or
        tags : ("cisco-sdwan", "vmanage")
      ) and
      not source.ip : ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
  ]
  [
    network where
      http.response.status_code in (200, 302) and
      (
        url.path like "/dataservice*" or
        url.path like "/api/*" or
        url.path like "/j_security_check*"
      )
  ]
  [
    any where
      event.action in ("authentication_success", "session_created", "login") and
      tags : ("cisco-sdwan", "vmanage", "sd-wan")
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  QIDNAME(qid) AS event_name,
  category,
  logsourcename(logsourceid) AS log_source,
  magnitude,
  COUNT(*) OVER (PARTITION BY sourceip ORDER BY starttime ROWS BETWEEN 299 PRECEDING AND CURRENT ROW) AS events_last_5min
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) ILIKE '%cisco%'
  AND (
    (
      LOGSOURCETYPENAME(devicetype) ILIKE '%sd-wan%'
      OR LOGSOURCETYPENAME(devicetype) ILIKE '%vmanage%'
      OR LOGSOURCETYPENAME(devicetype) ILIKE '%catalyst%'
    )
    OR (
      destinationport IN (443, 8443, 8080, 830, 8888)
      AND (
        UTF8(payload) ILIKE '%/dataservice%'
        OR UTF8(payload) ILIKE '%/j_security_check%'
        OR UTF8(payload) ILIKE '%unauthorized%'
        OR UTF8(payload) ILIKE '%auth bypass%'
        OR UTF8(payload) ILIKE '%authentication failure%'
      )
    )
  )
  AND NOT INCIDR(sourceip, '10.0.0.0/8')
  AND NOT INCIDR(sourceip, '172.16.0.0/12')
  AND NOT INCIDR(sourceip, '192.168.0.0/16')
  AND starttime > NOW() - 3600000
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=cisco/sdwan OR _sourceCategory=network/firewall OR _sourceCategory=cisco/vmanage
| where _sourceCategory matches "cisco*" or _sourceCategory matches "*sdwan*" or _sourceCategory matches "*vmanage*"
| parse "*" as raw_msg nodrop
| parse field=raw_msg "src=* " as src_ip nodrop
| parse field=raw_msg "dst=* " as dst_ip nodrop
| parse field=raw_msg "dport=*" as dst_port nodrop
| parse field=raw_msg "status=*" as http_status nodrop
| parse field=raw_msg "uri=*" as uri nodrop
| where (
    (uri matches "/dataservice*" or uri matches "/api/*" or uri matches "/j_security_check*")
    or (raw_msg matches "*authentication bypass*" or raw_msg matches "*unauthorized*" or raw_msg matches "*auth failed*")
    or dst_port in ("443", "8443", "8080", "830", "8888")
  )
| where !(src_ip matches "10.*" or src_ip matches "172.16.*" or src_ip matches "172.17.*" or src_ip matches "192.168.*")
| timeslice 5m
| stats
    count as event_count,
    count_distinct(src_ip) as unique_sources,
    values(uri) as accessed_paths,
    values(http_status) as http_statuses
  by _timeslice, dst_ip
| where event_count > 10 or unique_sources > 3
| fields _timeslice, dst_ip, event_count, unique_sources, accessed_paths, http_statuses
| sort by event_count desc

rule cisco_sdwan_auth_bypass_cve_2026_20182 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects authentication bypass exploitation of CVE-2026-20182 in Cisco Catalyst SD-WAN Controller"
    severity = "CRITICAL"
    priority = "HIGH"
    cve = "CVE-2026-20182"
    mitre_attack = "T1190, T1078, T1556"
    created = "2026-06-19"

  events:
    (
      $e1.metadata.event_type = "NETWORK_HTTP" or
      $e1.metadata.event_type = "NETWORK_CONNECTION" or
      $e1.metadata.event_type = "USER_LOGIN"
    )
    and (
      $e1.target.application = /(?i)(vmanage|vsmart|vbond|sd.wan|catalyst.sdwan)/ or
      $e1.target.port = 8443 or
      $e1.target.port = 830 or
      (
        $e1.target.port = 443 and
        (
          $e1.network.http.referral_url = /(?i)\/dataservice/ or
          $e1.network.http.referral_url = /(?i)\/j_security_check/
        )
      )
    )
    and (
      $e1.network.http.response_code = 200 or
      $e1.network.http.response_code = 302
    )
    and not net.ip_in_range_cidr($e1.principal.ip, "10.0.0.0/8")
    and not net.ip_in_range_cidr($e1.principal.ip, "172.16.0.0/12")
    and not net.ip_in_range_cidr($e1.principal.ip, "192.168.0.0/16")

  match:
    $e1.principal.ip over 5m

  outcome:
    $risk_score = max(
      if($e1.target.port = 830, 95,
      if($e1.target.port = 8443, 90, 80))
    )
    $event_count = count_distinct($e1.metadata.id)
    $target_ips = array_distinct($e1.target.ip)
    $source_ip = $e1.principal.ip

  condition:
    #e1 > 3
}

#event_simpleName IN (NetworkConnectIP4, NetworkConnectIP6, HttpRequest, ProcessRollup2)
| $targetPorts := [443, 8443, 8080, 830, 8888]
| $sdwanIndicators := ["vmanage", "vsmart", "vbond", "sdwan", "catalyst-sdwan", "/dataservice", "/j_security_check"]
| $externalRanges := ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
| case {
    #event_simpleName = "NetworkConnectIP4" |
      RemotePort IN $targetPorts
      AND NOT RemoteAddressIP4 IN CIDR($externalRanges)
      AND (
        HttpUrl LIKE "%dataservice%"
        OR HttpUrl LIKE "%j_security_check%"
        OR HttpUrl LIKE "%vmanage%"
      ) ;
    #event_simpleName = "ProcessRollup2" |
      FileName IN ["curl", "wget", "python3", "python", "ruby", "go"]
      AND CommandLine LIKE "%sdwan%"
      OR CommandLine LIKE "%vmanage%"
      OR CommandLine LIKE "%dataservice%" ;
    true | false
  }
| groupBy(
    [aid, ComputerName, UserName, RemoteAddressIP4, RemotePort, HttpUrl],
    function=[
      count(#event_simpleName, as=event_count),
      min(@timestamp, as=first_seen),
      max(@timestamp, as=last_seen)
    ]
  )
| where event_count > 5
| eval cve="CVE-2026-20182"
| eval vendor="Cisco"
| eval product="Catalyst SD-WAN"
| eval severity="critical"
| sort -event_count
| limit 200