CVE-2026-20128
Description
Cisco Catalyst SD-WAN Manager vulnerability (CVE-2026-20128) allows unauthenticated privilege escalation. High severity and actively exploited.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| catalyst_sd-wan_manager | * | 20.9.8.2 | vulnerable |
| catalyst_sd-wan_manager | 20.10 | 20.12.5.3 | vulnerable |
| catalyst_sd-wan_manager | 20.13 | 20.15.4.2 | vulnerable |
| catalyst_sd-wan_manager | 20.16 | 20.18 | vulnerable |
| catalyst_sd-wan_manager | 20.12.6 | 20.12.6 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Install the latest security updates provided by Cisco for the Catalyst SD-WAN Manager. Cisco has released software updates that address this vulnerability by removing the hardcoded or accessible credential file used by the Data Collection Agent.
Update affected systems
Ensure your Cisco Catalyst SD-WAN Manager is running version 20.18 or later. If using older branches, upgrade to at least 20.9.8.2, 20.12.5.3, or 20.15.4.2 to mitigate the risk of credential exposure.
Restrict access
Implement strict access control lists (ACLs) to limit HTTP/HTTPS access to the SD-WAN Manager interface. Ensure the management plane is not exposed to the public internet and is only accessible from trusted administrative subnets.
Monitor for exploitation
Review web server logs for unusual GET requests targeting configuration or credential files. Monitor for unexpected logins or activity associated with the DCA user account, which may indicate an attacker has successfully pivoted within the environment.
Detection Guidance
Monitor web server access logs for HTTP requests directed at sensitive file paths or Data Collection Agent (DCA) components. Look for unauthorized access attempts to local system files. Additionally, audit system logs for the creation of new DCA sessions from unexpected source IP addresses. Organizations should follow CISA's 'Hunt & Hardening' guidance, specifically looking for indicators of credential theft and lateral movement within the SD-WAN fabric.