Skip to content
Fencer Vulns
high 7.5

CVE-2026-20128 kev in the critical feed json

Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability

published 2026-02-25 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-8676

cvss
7.5
version 3.1, CNA
cisa kev
Exploited
added 2026-04-20
epss
8.3%
EPSS 8.3% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system.

This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.

Patch / fix

cisa required action Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

  • cisco catalyst_sd-wan_manager 20.9.8.2, 20.12.5.3, 20.15.4.2, 20.18

Timeline

  1. CISA SSVC: exploitation active
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline

Known exploited

Added
6 mo ago
Patch by
2026-04-23 (6 mo ago)
Ransomware
Not known
Required action
Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Vendor, product
Cisco, Catalyst SD-WAN Manager
CISA name
Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
8 mo ago

Exploit prediction

8.35% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Cisco Cisco Catalyst SD-WAN Manager

Classification

Weakness
  • CWE-257 Storing Passwords in a Recoverable Format

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.