CVE-2026-20182 Sumo Logic CSE · Sumo

Detect Cisco Catalyst SD-WAN Controller Authentication Bypass (CVE-2026-20182) in Sumo Logic CSE

Detects exploitation attempts of CVE-2026-20182, an authentication bypass vulnerability (CWE-287) in the Cisco Catalyst SD-WAN Controller. This KEV-listed vulnerability allows unauthenticated remote attackers to bypass authentication mechanisms and gain unauthorized access to the SD-WAN management plane. Successful exploitation can lead to full network fabric compromise, configuration tampering, and lateral movement across SD-WAN-connected sites.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Defense Evasion Lateral Movement

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=cisco/sdwan OR _sourceCategory=network/firewall OR _sourceCategory=cisco/vmanage
| where _sourceCategory matches "cisco*" or _sourceCategory matches "*sdwan*" or _sourceCategory matches "*vmanage*"
| parse "*" as raw_msg nodrop
| parse field=raw_msg "src=* " as src_ip nodrop
| parse field=raw_msg "dst=* " as dst_ip nodrop
| parse field=raw_msg "dport=*" as dst_port nodrop
| parse field=raw_msg "status=*" as http_status nodrop
| parse field=raw_msg "uri=*" as uri nodrop
| where (
    (uri matches "/dataservice*" or uri matches "/api/*" or uri matches "/j_security_check*")
    or (raw_msg matches "*authentication bypass*" or raw_msg matches "*unauthorized*" or raw_msg matches "*auth failed*")
    or dst_port in ("443", "8443", "8080", "830", "8888")
  )
| where !(src_ip matches "10.*" or src_ip matches "172.16.*" or src_ip matches "172.17.*" or src_ip matches "192.168.*")
| timeslice 5m
| stats
    count as event_count,
    count_distinct(src_ip) as unique_sources,
    values(uri) as accessed_paths,
    values(http_status) as http_statuses
  by _timeslice, dst_ip
| where event_count > 10 or unique_sources > 3
| fields _timeslice, dst_ip, event_count, unique_sources, accessed_paths, http_statuses
| sort by event_count desc
critical severity medium confidence

Sumo Logic query detecting external authentication bypass attempts against Cisco Catalyst SD-WAN management endpoints by correlating event volume, URI patterns, and external source IPs.

Data Sources

Cisco SD-WAN syslogsCisco vManage audit logsNetwork perimeter firewall logs

Required Tables

_sourceCategory=cisco/sdwan_sourceCategory=cisco/vmanage_sourceCategory=network/firewall

False Positives & Tuning

  • Third-party SD-WAN management overlays or SASE platforms with external IP addresses
  • Legitimate API polling from cloud-hosted monitoring services
  • Authorized VPN or remote access solutions that egress with public IP addresses
  • Partner or contractor administrative access from non-RFC1918 source ranges

Other platforms for CVE-2026-20182

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated vManage API Endpoint Enumeration

    Expected signal: HTTP GET requests to vManage management port (8443) targeting /dataservice/* and /j_security_check endpoints from the test host IP, captured in vManage access logs and network firewall logs. Response codes of 200 or 401/403 depending on vulnerability state.

  2. Test 2Authentication Bypass Session Token Forge Attempt

    Expected signal: POST requests to /j_security_check and GET requests to /dataservice/* with anomalous Authorization headers or malformed JSESSIONID cookies visible in vManage access logs, web proxy logs, and network PCAP. HTTP response codes of 200, 302, 401, or 403 depending on patch state.

  3. Test 3Post-Exploitation SD-WAN Configuration Exfiltration Simulation

    Expected signal: Sequential GET requests to /dataservice/device, /dataservice/template/device, and /dataservice/system/device/controllers within a short time window, all using the same session cookie. Requests captured in vManage audit log as API access events and in network logs as HTTPS traffic to management port.

Last updated: 2026-06-19 Research depth: standard
References (4)

Unlock Pro Content

Get the full detection package for CVE-2026-20182 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0005Defense EvasionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1556Modify Authentication ProcessT1021.007Cloud Services

Same Tactic: Initial Access

Popular Detections