Detect Cisco Catalyst SD-WAN Controller Authentication Bypass (CVE-2026-20182) in Splunk

index=network OR index=cisco OR index=firewall OR index=proxy
(
  (sourcetype="cisco:ios" OR sourcetype="cisco:sdwan" OR sourcetype="cisco:vmanage")
  (
    ("authentication bypass" OR "auth bypass" OR "unauthorized access" OR "CWE-287")
    OR ("vManage" AND ("401" OR "403" OR "login failed" OR "session invalid"))
    OR ("vSmart" AND ("unauthorized" OR "privilege escalation"))
    OR ("vBond" AND ("authentication" AND ("failed" OR "bypass" OR "invalid")))
  )
)
OR
(
  sourcetype="access_combined" OR sourcetype="apache:access"
  (uri_path="/dataservice*" OR uri_path="/api/*" OR uri_path="/j_security_check*")
  (status=200 OR status=302)
  NOT (src_ip="10.*" OR src_ip="172.16.*" OR src_ip="192.168.*")
)
OR
(
  sourcetype="cisco:asa" OR sourcetype="pan:traffic"
  (dest_port=443 OR dest_port=8443 OR dest_port=8080 OR dest_port=830)
  action=allowed
  (app="ssl" OR app="https")
)
| eval cve="CVE-2026-20182"
| eval vendor="Cisco"
| eval product="Catalyst SD-WAN"
| eval severity="critical"
| bucket _time span=5m
| stats
    count AS event_count,
    dc(src_ip) AS unique_src_ips,
    values(src_ip) AS source_ips,
    values(dest_ip) AS dest_ips,
    values(uri_path) AS accessed_paths,
    min(_time) AS first_seen,
    max(_time) AS last_seen
  BY _time, cve, vendor, product, severity
| where event_count > 5 OR unique_src_ips > 3
| sort -event_count