Detect Cisco Catalyst SD-WAN Controller Authentication Bypass (CVE-2026-20182) in CrowdStrike LogScale
Detects exploitation attempts of CVE-2026-20182, an authentication bypass vulnerability (CWE-287) in the Cisco Catalyst SD-WAN Controller. This KEV-listed vulnerability allows unauthenticated remote attackers to bypass authentication mechanisms and gain unauthorized access to the SD-WAN management plane. Successful exploitation can lead to full network fabric compromise, configuration tampering, and lateral movement across SD-WAN-connected sites.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName IN (NetworkConnectIP4, NetworkConnectIP6, HttpRequest, ProcessRollup2)
| $targetPorts := [443, 8443, 8080, 830, 8888]
| $sdwanIndicators := ["vmanage", "vsmart", "vbond", "sdwan", "catalyst-sdwan", "/dataservice", "/j_security_check"]
| $externalRanges := ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
| case {
#event_simpleName = "NetworkConnectIP4" |
RemotePort IN $targetPorts
AND NOT RemoteAddressIP4 IN CIDR($externalRanges)
AND (
HttpUrl LIKE "%dataservice%"
OR HttpUrl LIKE "%j_security_check%"
OR HttpUrl LIKE "%vmanage%"
) ;
#event_simpleName = "ProcessRollup2" |
FileName IN ["curl", "wget", "python3", "python", "ruby", "go"]
AND CommandLine LIKE "%sdwan%"
OR CommandLine LIKE "%vmanage%"
OR CommandLine LIKE "%dataservice%" ;
true | false
}
| groupBy(
[aid, ComputerName, UserName, RemoteAddressIP4, RemotePort, HttpUrl],
function=[
count(#event_simpleName, as=event_count),
min(@timestamp, as=first_seen),
max(@timestamp, as=last_seen)
]
)
| where event_count > 5
| eval cve="CVE-2026-20182"
| eval vendor="Cisco"
| eval product="Catalyst SD-WAN"
| eval severity="critical"
| sort -event_count
| limit 200CrowdStrike LogScale/Falcon query correlating network connections and process executions indicative of authentication bypass attempts against Cisco Catalyst SD-WAN management interfaces from endpoints in the environment.
Data Sources
Required Tables
False Positives & Tuning
- Security tools on endpoints making API calls to SD-WAN for monitoring purposes
- Developers or network engineers using curl/python scripts for SD-WAN automation from managed endpoints
- Authorized penetration testing from enrolled endpoints
- Ansible or Terraform-based network automation tools installed on managed hosts
Other platforms for CVE-2026-20182
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated vManage API Endpoint Enumeration
Expected signal: HTTP GET requests to vManage management port (8443) targeting /dataservice/* and /j_security_check endpoints from the test host IP, captured in vManage access logs and network firewall logs. Response codes of 200 or 401/403 depending on vulnerability state.
- Test 2Authentication Bypass Session Token Forge Attempt
Expected signal: POST requests to /j_security_check and GET requests to /dataservice/* with anomalous Authorization headers or malformed JSESSIONID cookies visible in vManage access logs, web proxy logs, and network PCAP. HTTP response codes of 200, 302, 401, or 403 depending on patch state.
- Test 3Post-Exploitation SD-WAN Configuration Exfiltration Simulation
Expected signal: Sequential GET requests to /dataservice/device, /dataservice/template/device, and /dataservice/system/device/controllers within a short time window, all using the same session cookie. Requests captured in vManage audit log as API access events and in network logs as HTTPS traffic to management port.
References (4)
- https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems
- https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
- https://nvd.nist.gov/vuln/detail/CVE-2026-20182
Unlock Pro Content
Get the full detection package for CVE-2026-20182 including response playbook, investigation guide, and atomic red team tests.