CVE-2026-20128: high-severity vulnerability in Cisco Catalyst SD-WAN Manager
Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Cisco Catalyst SD-WAN Manager exposes a password file that an unauthenticated attacker can read remotely via a crafted HTTP request. Once obtained, this password allows the attacker to gain access to other systems with the same credentials.
The Data Collection Agent (DCA) credential file is accessible to unauthenticated remote attackers through a specially crafted HTTP request, enabling credential disclosure. An attacker can leverage the obtained DCA user credentials to authenticate and gain unauthorized access to other affected Catalyst SD-WAN Manager instances. Affects versions prior to 20.18; exploitation requires network access to the vulnerable system.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.