Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
Affects Cisco Catalyst SD-WAN Manager releases before 20.18, regardless of device configuration. No vendor rating or fixed release is listed.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Cisco Catalyst SD-WAN Manager is affected by this vulnerability, which lies in its Data Collection Agent feature. A remote attacker without credentials could read a stored file containing the Data Collection Agent password and use it to gain that user's privileges on other affected systems.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
Affected versions
- Cisco Cisco Catalyst SD-WAN Manager
20.1.12, 19.2.1, 18.4.4, 18.4.5, 20.1.1.1, 20.1.1, 19.3.0, 19.2.2, 19.2.099, 18.3.6, 18.3.7, 19.2.0, 18.3.8, 19.0.0, 19.1.0, 18.4.302, 18.4.303, 19.2.097, 19.2.098, 17.2.10, 18.3.6.1, 19.0.1a, 18.2.0, 18.4.3, 18.4.1, 17.2.8, 18.3.3.1, 18.4.0, 18.3.1, 17.2.6, and 106 more
References 1
sec.cloudapps.cisco.com
Questions about CVE-2026-20128
What does this mean?
A flaw in the Data Collection Agent (DCA) feature lets an attacker send a crafted HTTP request to read the file that holds the DCA password. With that password, the attacker could reach another affected system and gain DCA user privileges.Source: sec.cloudapps.cisco.com
Am I affected, and how do I check?
Cisco Catalyst SD-WAN Manager releases before 20.18 are affected, and releases 20.18 and later are not. The issue applies regardless of device configuration, so compare the Manager release version against 20.18.Source: sec.cloudapps.cisco.com
What should I do about it?
The checked facts list releases 20.18 and later as not affected, but they do not name a fixed release. Consult Cisco's advisory for the upgrade path.Source: sec.cloudapps.cisco.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-04-20, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
The checked facts give no workaround and no fix. They do not say what limits the exposure before a fix is available.Source: sec.cloudapps.cisco.com
Why do the sources disagree?
The description says the flaw is unauthenticated and remote, but the CVSS vector lists PR:H (high privileges required) and AV:L (local access). The sources conflict on whether authentication and network reach are needed.Source: sec.cloudapps.cisco.com