CVE-2026-20133: medium-severity vulnerability in Cisco Catalyst SD-WAN Manager
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
A flaw in Cisco Catalyst SD-WAN Software allows someone with administrative network access to read sensitive files on the system through a command interface. This happens because the system doesn't properly restrict who can access certain files.
CWE-200 information disclosure vulnerability in Cisco Catalyst SD-WAN where authenticated users with netadmin privileges can access vshell and bypass file system restrictions to read sensitive operating system files. Attack requires valid credentials and administrative role; successful exploitation exposes confidential data on the underlying OS.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.