{
  "document": {
    "acknowledgments": [
      {
        "summary": "These vulnerabilities were found during internal security testing by Arthur Vidineyev of the Cisco Advanced Security Initiatives Group (ASIG)."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an attacker to access an affected system, elevate privileges to root, gain access to sensitive information, and overwrite arbitrary files.\r\n\r\nFor more information about these vulnerabilities, see the Details [\"#details\"] section of this advisory.\r\n\r\nCisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.\r\n\r\nCisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.\r\n\r\n",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "These vulnerabilities affect Cisco Catalyst SD-WAN Manager, regardless of device configuration.\r\n\r\nFor information about which Cisco software releases are vulnerable, see the Fixed Software [\"#fs\"] section of this advisory.\r\n\r\nCisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by these vulnerabilities.\r\n\r\nCisco has confirmed that Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by the vulnerabilities that are described in CVE-2026-20128 and CVE-2026-20129.\r\n\r\nCisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "These vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit another vulnerability.\r\n\r\nCisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.\r\n\r\nDetails about the vulnerabilities are as follows:\r\n\r\nCVE-2026-20129: Cisco Catalyst SD-WAN Manager Authentication Bypass Vulnerability\r\n\r\nA vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected system as a user who has the netadmin role.\r\n\r\nThe vulnerability is due to improper authentication for requests that are sent to the API. An attacker could exploit this vulnerability by sending a crafted request to the API of an affected system. A successful exploit could allow the attacker to execute commands with the privileges of the netadmin role.\r\n\r\nNote: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\nBug ID(s): CSCws33587 [\"https://bst.cisco.com/bugsearch/bug/CSCws33587\"]\r\nCVE ID: CVE-2026-20129\r\nSecurity Impact Rating (SIR): Critical\r\nCVSS Base Score: 9.8\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\r\n\r\nCVE-2026-20126: Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability\r\n\r\nA vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system.\r\n\r\nThis vulnerability is due to an insufficient user authentication mechanism in the REST API. An attacker could exploit this vulnerability by sending a request to the REST API of the affected system. A successful exploit could allow the attacker to gain root privileges on the underlying operating system.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\nBug ID(s): CSCws93470 [\"https://bst.cisco.com/bugsearch/bug/CSCws93470\"]\r\nCVE ID: CVE-2026-20126\r\nSecurity Impact Rating (SIR): High\r\nCVSS Base Score: 7.8\r\nCVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\r\n\r\nCVE-2026-20133: Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability\r\n\r\nA vulnerability in Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to view sensitive information on an affected system.\r\n\r\nThis vulnerability is due to insufficient file system access restrictions. An attacker could exploit this vulnerability by accessing the API of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\nBug ID(s): CSCws33583 [\"https://bst.cisco.com/bugsearch/bug/CSCws33583\"]\r\nCVE ID: CVE-2026-20133\r\nSecurity Impact Rating (SIR): High\r\nCVSS Base Score: 7.5\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\r\n\r\nCVE-2026-20122: Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability\r\n\r\nA vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system.\r\n\r\nThis vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\nBug ID(s): CSCws33584 [\"https://bst.cisco.com/bugsearch/bug/CSCws33584\"], CSCws33586 [\"https://bst.cisco.com/bugsearch/bug/CSCws33586\"]\r\nCVE ID: CVE-2026-20122\r\nSecurity Impact Rating (SIR): High\r\nCVSS Base Score: 7.1\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L\r\n\r\nCVE-2026-20128: Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability\r\n\r\nA vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system.\r\n\r\nThis vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges.\r\n\r\nNote: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\nBug ID(s): CSCws33585 [\"https://bst.cisco.com/bugsearch/bug/CSCws33585\"]\r\nCVE ID: CVE-2026-20128\r\nSecurity Impact Rating (SIR): High\r\nCVSS Base Score: 7.5\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
        "title": "Details"
      },
      {
        "category": "general",
        "text": "Indicators of compromise for the exploitation of CVE-2026-20128 and CVE-2026-20122 are as follows.\r\n\r\nCVE-2026-20128: Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability\r\n\r\nCustomers are encouraged to examine log entries in the file /var/log/nms/containers/service-proxy/serviceproxy-access.log on a Cisco Catalyst SD-WAN Manager for references to /reports/data/opt/data/containers/config/data-collection-agent/.dca. Legitimate use of this API occurs when administering the DCA and would coincide with this activity. In such a case, the corresponding IP address would be that of the laptop of the administrator.\r\n\r\nTo identify indicators of compromise and remove false positives, search the file /var/log/nms/containers/service-proxy/serviceproxy-access.log for log entries such as the following:\r\n\r\n\r\n[2026-03-04T18:14:16.057Z] \"GET /reports/data/opt/data/containers/config/data-collection-agent/.dca HTTP/1.1\" 200 - 0 32 4 - \"172.16.1.1\" \"python-requests/2.31.0\" \"7e77bfbc-7224-43e0-9115-cadf13d2fefa\" \"172.16.0.1\" \"127.0.0.1:8080\"\r\n\r\nCompare the log time and source IP (in this example, 172.16.1.1) against known administrator activity to exclude false positives.\r\n\r\nCVE-2026-20122: Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability\r\n\r\nExamine log entries in the file /var/log/nms/containers/service-proxy/serviceproxy-access.log on a Cisco Catalyst SD-WAN Manager for references to /dataservice/smartLicensing/uploadAck. Legitimate use of this API occurs when updating licensing information and would coincide with this activity. In such a case, the corresponding IP address would be that of the laptop of the administrator.\r\n\r\nTo identify indicators of compromise and remove false positives, search the file /var/log/nms/containers/service-proxy/serviceproxy-access.log for log entries such as the following:\r\n\r\n\r\n[2026-03-05T14:28:05.106Z] \"POST /dataservice/smartLicensing/uploadAck HTTP/1.1\" 0 DC 1036 0 10010 - \"10.10.10.23\"\r\n\r\nCompare the log time and source IP (in this example, 10.10.10.23) against known administrator activity to exclude false positives.\r\n\r\nIf customers see the following POST log example, they should also check the vmanage-server.log file for specific filenames being downloaded:\r\n\r\n\r\n[2026-03-05T14:28:05.106Z] \"POST /dataservice/smartLicensing/uploadAck HTTP/1.1\" 0 DC 1036 0 10010 - \"10.10.10.23\"\r\n\r\nThe following list includes example logs for filenames. Flag them if the file is suspicious.\r\n\r\n\r\n/var/log/nms/vmanage-server.log-03-06-2026-1.gz:06-Mar-2026 02:16:34,029 UTC INFO  [285fcdc0-30fa-4ca0-8e06-6953a095a59a] [LAB-TEST-1] [SmartLicensingManager] (default task-11229) |57501bad-32a7-4f52-8f54-8547dcd7403e| Time taken to write file ../../../../../../../../../../../var/lib/wildfly/standalone/deployments/cmd.gz.war = 2 ms to directory /opt/data/app-server/software/package/license/ack\r\n/var/log/nms/vmanage-server.log-03-06-2026-1.gz:06-Mar-2026 02:16:34,029 UTC INFO  [285fcdc0-30fa-4ca0-8e06-6953a095a59a] [LAB-TEST-1] [SmartLicensingManager] (default task-11229) |57501bad-32a7-4f52-8f54-8547dcd7403e| ../../../../../../../../../../../var/lib/wildfly/standalone/deployments/cmd.gz.war is processing in rpc call\r\n/var/log/nms/vmanage-server.log-03-06-2026-1.gz:06-Mar-2026 02:16:34,094 UTC INFO  [] [sd-wan-manager-0] [SmartLicensingManager] (pool-187-thread-1) || stringUrl  https://10.0.6.144:8443/software/package/license/ack/../../../../../../../../../../../var/lib/wildfly/standalone/deployments/cmd.gz.war filePath ../../../../../../../../../../../var/lib/wildfly/standalone/deployments/cmd.gz.war\r\n/var/log/nms/vmanage-server.log-03-06-2026-1.gz:06-Mar-2026 02:16:34,106 UTC ERROR [] [sd-wan-manager-0] [SmartLicensingManager] (pool-187-thread-1) || Failed to download the file ../../../../../../../../../../../var/lib/wildfly/standalone/deployments/cmd.gz.war\r\n\r\nNote: The filename shown here is an example. The actual log entry may contain a different filename.\r\n\r\nCustomers are also encouraged to check for the presence of file /cmd.gz/cmd.jsp. Examine log entries in the file /var/log/nms/containers/service-proxy/serviceproxy-access.log on a Cisco Catalyst SD-WAN Manager for references to /cmd.gz/cmd.jsp. This is an endpoint that does not exist on a clean Cisco Catalyst SD-WAN Manager but is added by the published proof of concept. Any use of this endpoint is an indicator of compromise, as shown in the following example log:\r\n\r\n\r\n[2026-03-05T14:54:01.541Z] \"POST /cmd.gz/cmd.jsp HTTP/1.1\" 200 - 6 63 7 - \"172.16.1.1\" \"python-requests/2.31.0\" \"7221a300-088a-4a44-84a1-b8388a8ee19e\" \"172.16.0.1\" \"127.0.0.1:8080\"\r\n\r\nNote: The filename shown here is an example. The actual log entry may contain a different filename.",
        "title": "Indicators of Compromise"
      },
      {
        "category": "general",
        "text": "There are no workarounds that address these vulnerabilities. Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate these vulnerabilities and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.\r\n      Fixed Releases\r\nIn the following tables, the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerabilities that are described in this advisory and the first release that includes the fix for these vulnerabilities. Customers are advised to upgrade to an appropriate fixed software release [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"] as indicated in this section.\r\n        Cisco Catalyst SD-WAN Manager Release  First Fixed Release          Earlier than 20.91  Migrate to a fixed release.      20.9  20.9.8.2      20.10  20.12.6.1      20.111  20.12.6.1      20.12  20.12.5.3\r\n20.12.6.1      20.131  20.15.4.2      20.141  20.15.4.2      20.15  20.15.4.2      20.161  20.18.2.1      20.18  20.18.2.1\r\n1. These releases have reached End of Software Maintenance [\"https://www.cisco.com/c/en/us/products/routers/sd-wan/eos-eol-notice-listing.html\"]. Cisco strongly encourages customers to upgrade to a supported release [\"https://www.cisco.com/c/en/us/td/docs/routers/sdwan/release/notes/compatibility-and-server-recommendations.html\"].\r\nThe Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.\r\n\r\nAdditional Information\r\n\r\nTo check component and software release compatibility, see the SD-WAN Controller Component Compatibility Matrix [\"https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/catalyst_sdwan_compatibility_matrix/index.html\"].\r\nFor help planning an upgrade, see the Cisco Catalyst SD-WAN Upgrade Matrix [\"https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/catalyst-sdwan-upgrade-matrix/index.html\"].\r\nFor additional remediation assistance, see Remediate Catalyst SD-WAN Security Advisory - February 2026 [\"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/225525-internal-remediate-catalyst-sd-wan.html\"].\r\nFor additional assistance with requesting the admin-tech bundle for TAC support, see Collect an Admin-Tech in SD-WAN Environment and Upload to TAC Case [\"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/216954-how-to-collect-an-admin-tech-in-an-sd-wa.html\"].\r\nFor additional remediation assistance, see Rebuild Your Catalyst SD-WAN Fabric [\"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/225526-rebuild-your-catalyst-sd-wan-fabric.html\"].",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "Cisco recommends upgrading the affected systems to a fixed software release.\r\n\r\nGeneral Recommendations for Hardening\r\n\r\nPrevent access from unsecured networks, such as the internet, to the system. If internet access to the system is required, restrict system access to only known, trusted hosts on ports/protocols that are included in the user guides.\r\nProtect Cisco Catalyst SD-WAN Control Components behind a filtering device such as a firewall, and filter traffic to and from the systems while allowing only known, trusted hosts to send traffic to the systems. Using a two-layer firewall can provide flexibility in network planning so that end users do not connect directly to the outer DMZ. See the Deployment sections of the User Guides for Cisco Catalyst SD-WAN software [\"https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html#DeploymentPlanning\"].\r\nRegularly monitor log traffic for any unexpected traffic to and from systems. Logging should be sent to an external server, if possible, and kept for a long enough duration so that post-event investigations can be performed with sufficient log data.\r\nDisable HTTP for the Cisco Catalyst SD-WAN Manager web UI administrator portal.\r\nDisable any network services that are not required, including HTTP and FTP. For more information about specific service functionality, see the Cisco Catalyst SD-WAN user guides.\r\nUpgrade the system to the latest version of Cisco Catalyst SD-WAN Software.\r\nChange the default administrator password to a more secure variant. Restrict access to the administrator account by creating user accounts based on necessary access requirements. In addition, create operator accounts for all administrators.\r\nUse SSL/TLS, obtain an SSL certificate from a certificate authority (CA), or create a self-signed certificate.\r\n\r\nFor more information, review the Cisco Catalyst SD-WAN Hardening Guide [\"https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide\"].",
        "title": "Recommendations"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in CVE-2026-20126 and CVE-2026-20129.\r\n\r\nIn March 2026, the Cisco PSIRT became aware of active exploitation of the vulnerabilities that are described in CVE-2026-20128 and CVE-2026-20122 only. The vulnerabilities that are described in the other CVEs in this advisory are not known to have been compromised. Cisco strongly recommends that customers upgrade to a fixed software release to remediate these vulnerabilities.\r\n\r\nIn April 2026, the Cisco PSIRT became aware of active exploitation of the vulnerability that is described in CVE-2026-20133. Cisco strongly recommends that customers upgrade to a fixed software release to remediate these vulnerabilities.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "These vulnerabilities were found during internal security testing by Arthur Vidineyev of the Cisco Advanced Security Initiatives Group (ASIG).",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT\r\n\r\nThe Cisco Support and Downloads [\"https://www.cisco.com/c/en/us/support/index.html\"] page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid.\r\n\r\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]. Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories [\"https://www.cisco.com/go/psirt\"] for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"] or their contracted maintenance providers.\r\n    LEGAL DISCLAIMER DETAILS\r\n\r\nCISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nCopies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the Cisco Security Advisories [\"https://www.cisco.com/go/psirt\"] page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the Cisco Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"] for more information.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@cisco.com",
      "issuing_authority": "Cisco PSIRT",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Cisco Catalyst SD-WAN Vulnerabilities",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "CSCws33587",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCws33587"
      },
      {
        "category": "external",
        "summary": "CSCws93470",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCws93470"
      },
      {
        "category": "external",
        "summary": "CSCws33583",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCws33583"
      },
      {
        "category": "external",
        "summary": "CSCws33584",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCws33584"
      },
      {
        "category": "external",
        "summary": "CSCws33586",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCws33586"
      },
      {
        "category": "external",
        "summary": "CSCws33585",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCws33585"
      },
      {
        "category": "external",
        "summary": "fixed software release",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "End of Software Maintenance",
        "url": "https://www.cisco.com/c/en/us/products/routers/sd-wan/eos-eol-notice-listing.html"
      },
      {
        "category": "external",
        "summary": "supported release",
        "url": "https://www.cisco.com/c/en/us/td/docs/routers/sdwan/release/notes/compatibility-and-server-recommendations.html"
      },
      {
        "category": "external",
        "summary": "SD-WAN Controller Component Compatibility Matrix",
        "url": "https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/catalyst_sdwan_compatibility_matrix/index.html"
      },
      {
        "category": "external",
        "summary": "Cisco Catalyst SD-WAN Upgrade Matrix",
        "url": "https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/catalyst-sdwan-upgrade-matrix/index.html"
      },
      {
        "category": "external",
        "summary": "Remediate Catalyst SD-WAN Security Advisory - February 2026",
        "url": "https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/225525-internal-remediate-catalyst-sd-wan.html"
      },
      {
        "category": "external",
        "summary": "Collect an Admin-Tech in SD-WAN Environment and Upload to TAC Case",
        "url": "https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/216954-how-to-collect-an-admin-tech-in-an-sd-wa.html"
      },
      {
        "category": "external",
        "summary": "Rebuild Your Catalyst SD-WAN Fabric",
        "url": "https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/225526-rebuild-your-catalyst-sd-wan-fabric.html"
      },
      {
        "category": "external",
        "summary": "Deployment sections of the User Guides for Cisco Catalyst SD-WAN software",
        "url": "https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html#DeploymentPlanning"
      },
      {
        "category": "external",
        "summary": "Cisco Catalyst SD-WAN Hardening Guide",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "Cisco Support and Downloads",
        "url": "https://www.cisco.com/c/en/us/support/index.html"
      },
      {
        "category": "external",
        "summary": "Cisco Technical Assistance Center (TAC)",
        "url": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"
      },
      {
        "category": "external",
        "summary": "the advisories",
        "url": "https://www.cisco.com/go/psirt"
      }
    ],
    "title": "Cisco Catalyst SD-WAN Vulnerabilities",
    "tracking": {
      "current_release_date": "2026-04-22T15:10:56+00:00",
      "generator": {
        "date": "2026-04-22T15:11:01+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-sdwan-authbp-qwCX8D4v",
      "initial_release_date": "2026-02-25T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-02-25T15:59:38+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        },
        {
          "date": "2026-03-05T00:06:17+00:00",
          "number": "1.1.0",
          "summary": "Updated Exploitation and Public Announcements section to include active exploitation of CVE-2026-20128 and CVE-2026-20122. Added links with instructions for uploading admin-tech files into a Cisco TAC case and rebuilding an SD-WAN fabric. Added additional language strongly recommending that customers upgrade to the fixed software indicated in this advisory."
        },
        {
          "date": "2026-03-18T01:06:38+00:00",
          "number": "1.2.0",
          "summary": "Updated the Details section for CVE-2026-20128. Added indicators of compromise for CVE-2026-20128 and CVE-2026-20122. Added Release 20.10 to fixed release table."
        },
        {
          "date": "2026-04-22T15:10:56+00:00",
          "number": "1.3.0",
          "summary": "Added information about active exploitation of CVE-2026-20133."
        }
      ],
      "status": "final",
      "version": "1.3.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Cisco Catalyst SD-WAN Manager",
            "product": {
              "name": "Cisco Catalyst SD-WAN Manager ",
              "product_id": "CSAFPID-271450"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-20126",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCws93470"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-271450"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-271450"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-271450"
          ]
        }
      ],
      "title": "Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability"
    },
    {
      "cve": "CVE-2026-20122",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCws33584"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCws33586"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-271450"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-271450"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-271450"
          ]
        }
      ],
      "title": "Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability"
    },
    {
      "cve": "CVE-2026-20128",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCws33585"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-271450"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-271450"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-271450"
          ]
        }
      ],
      "title": "Cisco Catalyst SD-WAN Manager Static Credential Vulnerability"
    },
    {
      "cve": "CVE-2026-20129",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCws33587"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-271450"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-271450"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-271450"
          ]
        }
      ],
      "title": "Cisco Catayst SD-WAN Authentication Bypass Vulnerability"
    },
    {
      "cve": "CVE-2026-20133",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCws33583"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-271450"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-271450"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-271450"
          ]
        }
      ],
      "title": "Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions ant\u00e9rieures \u00e0 20.9.8.2",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.12.6.x ant\u00e9rieures \u00e0 20.12.6.1",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.15.x ant\u00e9rieures \u00e0 20.15.4.2",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.18.x ant\u00e9rieures \u00e0 20.18.2.1",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.12.5.x ant\u00e9rieures \u00e0 20.12.5.3",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "Cisco indique que la publication de la version corrective 20.9.8.2 pour Catalyst SD-WAN et Catalyst SD-WAN Manager est pr\u00e9vue le 27 f\u00e9vrier 2026. Les versions 20.11.x, 20.13.x, 20.14.x et 20.16.x sont affect\u00e9es par les vuln\u00e9rabilit\u00e9s mais ne b\u00e9n\u00e9ficieront pas de correctifs de s\u00e9curit\u00e9 car elles ont atteint la fin de p\u00e9riode de maintenance. Le CERT-FR recommande de migrer vers une version maintenue et avec les derniers correctifs de s\u00e9curit\u00e9.\n\nL\u0027\u00e9diteur pr\u00e9cise aussi que la solution Cisco SD-WAN a \u00e9t\u00e9 renomm\u00e9e Cisco Catalyst SD-WAN. Les avis \u00e9diteurs indiquent \u00e9galement d\u0027autres changements de noms pour les composants de cette solution. ",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-20126",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20126"
    },
    {
      "name": "CVE-2026-20128",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20128"
    },
    {
      "name": "CVE-2026-20122",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20122"
    },
    {
      "name": "CVE-2026-20129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20129"
    },
    {
      "name": "CVE-2026-20127",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20127"
    },
    {
      "name": "CVE-2026-20133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20133"
    }
  ],
  "initial_release_date": "2026-02-25T00:00:00",
  "last_revision_date": "2026-02-25T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0210",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-02-25T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Cisco Catalyst SD-WAN. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n\nCisco indique que la vuln\u00e9rabilit\u00e9 CVE-2026-20127 est activement exploit\u00e9e.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Cisco Catalyst SD-WAN",
  "vendor_advisories": [
    {
      "published_at": "2026-02-25",
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sdwan-authbp-qwCX8D4v",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"
    },
    {
      "published_at": "2026-02-25",
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sdwan-rpa-EHchtZk",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0388BD67-C1AD-4E47-8B1A-22EE1634190E",
              "versionEndExcluding": "20.9.8.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ADAB32B5-239D-4DC0-BF30-A6D72ACB3710",
              "versionEndExcluding": "20.12.5.3",
              "versionStartIncluding": "20.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D284EA84-6C27-4A9C-BDA2-D1C5BF1F2356",
              "versionEndExcluding": "20.15.4.2",
              "versionStartIncluding": "20.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "79B0897E-0FF3-44CA-901F-A10A6921672D",
              "versionEndExcluding": "20.18",
              "versionStartIncluding": "20.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5B6E170-73B8-4838-93B4-AD258F3BCA7C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system.\r\n\r\nThis vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges.\r\nNote: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la funci\u00f3n de Agente de Recopilaci\u00f3n de Datos (DCA) de Cisco Catalyst SD-WAN Manager podr\u00eda permitir a un atacante local autenticado obtener privilegios de usuario de DCA en un sistema afectado. Para explotar esta vulnerabilidad, el atacante debe tener credenciales v\u00e1lidas de vmanage en el sistema afectado.\n\nEsta vulnerabilidad se debe a la presencia de un archivo de credenciales para el usuario de DCA en un sistema afectado. Un atacante podr\u00eda explotar esta vulnerabilidad al acceder al sistema de archivos como un usuario con privilegios bajos y leer el archivo que contiene la contrase\u00f1a de DCA de ese sistema afectado. Un exploit exitoso podr\u00eda permitir al atacante acceder a otro sistema afectado y obtener privilegios de usuario de DCA.\nNota: Las versiones 20.18 y posteriores de Cisco Catalyst SD-WAN Manager no se ven afectadas por esta vulnerabilidad."
    }
  ],
  "id": "CVE-2026-20128",
  "lastModified": "2026-04-21T12:48:20.987",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 6.0,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-25T17:25:30.150",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-257"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Cisco heeft meerdere kwetsbaarheden verholpen in de Cisco Catalyst SD-WAN Manager.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden bevinden zich in de peering authenticatiemechanismen van de Cisco Catalyst SD-WAN Controller en Manager producten. Deze kwetsbaarheden stellen een niet-geauthenticeerde externe aanvaller in staat om het authenticatieproces te omzeilen, waardoor administratieve privileges op de getroffen systemen kunnen worden verkregen. Daarnaast kunnen aanvallers root-level privileges verkrijgen, wat kan leiden tot ongeautoriseerde toegang tot gevoelige informatie en de mogelijkheid om willekeurige bestanden te overschrijven, wat kan resulteren in verdere exploitatie of systeeminstabiliteit.\n\nDe meest ernstige kwetsbaarheid, met kenmerk CVE-2026-20127, kan door een ongeauthenticeerde kwaadwillende worden misbruikt om op afstand willekeurige code uit te voeren met hoge administratieve rechten. Cisco geeft aan dat actief misbruik van deze kwetsbaarheid bekend is.\n\nNa misbruik van deze kwetsbaarheid zou de kwaadwillende de kwetsbaarheid met kenmerk CVE-2022-20775 gebruiken om de rechten te escaleren tot root. Dit doet de actor door het systeem te downgraden naar een versie waarin CVE-2022-20775 niet verholpen is, de rechten middels deze kwetsbaarheid te verhogen naar root en vervolgens het systeem weer terug te zetten in de oorspronkelijke versie.\n\nEr is publieke Proof-of-Concept-code (PoC) verschenen die de kwetsbaarheid met kenmerk CVE-2026-20127 aantoont en mogelijk misbruikt. De kans op grootschalig misbruik neemt hierdoor toe en het NCSC verwacht een significante toename in scan- en misbruikverkeer. Het NCSC adviseert met klem de update zo spoedig mogelijk te installeren.\n\nOok van de kwetsbaarheden met kenmerk CVE-2026-20122 en CVE-2026-20128 meldt Cisco berichten te ontvangen dat deze actief worden misbruikt. Voor deze kwetsbaarheden is (nog) geen publieke Proof-of-Concept-code of exploit beschikbaar.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. In een blog geeft Talos informatie over het bekende misbruik en is er een validatie checklist  beschikbaar gesteld met uitleg hoe deze kan worden toegepast. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      },
      {
        "category": "general",
        "text": "Storing Passwords in a Recoverable Format",
        "title": "CWE-257"
      },
      {
        "category": "general",
        "text": "Improper Authentication",
        "title": "CWE-287"
      },
      {
        "category": "general",
        "text": "Incorrect Use of Privileged APIs",
        "title": "CWE-648"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://blog.talosintelligence.com/uat-8616-sd-wan"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Cisco Catalyst SD-WAN Manager",
    "tracking": {
      "current_release_date": "2026-03-06T12:07:02.595940Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0071",
      "initial_release_date": "2026-02-25T17:11:09.013125Z",
      "revision_history": [
        {
          "date": "2026-02-25T17:11:09.013125Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        },
        {
          "date": "2026-03-06T07:24:19.834138Z",
          "number": "1.0.1",
          "summary": "Inmiddels is Proof-of-Concept-Code (PoC) verschenen die de kwetsbaarheid aantoont. "
        },
        {
          "date": "2026-03-06T12:07:02.595940Z",
          "number": "1.0.2",
          "summary": "Ook de kwetsbaarheden met kenmerk CVE-2026-20122 en CVE-2026-20128 worden actief misbruikt volgens Cisco."
        }
      ],
      "status": "final",
      "version": "1.0.2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Catalyst SD-WAN Manager"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Cisco Catalyst SD-WAN"
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-20122",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager APIs allow authenticated users with read-only credentials to overwrite arbitrary files and escalate privileges to root, compromising system integrity and sensitive information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20122 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20122.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-20122"
    },
    {
      "cve": "CVE-2026-20126",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager\u0027s REST API allow authenticated local attackers with low privileges to escalate to root, access sensitive information, and overwrite arbitrary files on the underlying system.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20126 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20126.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-20126"
    },
    {
      "cve": "CVE-2026-20127",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "description",
          "text": "Cisco Catalyst SD-WAN Controller and Manager have a peering authentication vulnerability allowing unauthenticated remote attackers to bypass authentication and gain administrative access to manipulate network configurations via NETCONF.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20127 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20127.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-20127"
    },
    {
      "cve": "CVE-2026-20128",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, including a local privilege escalation via credential file access in versions prior to 20.18, allow authenticated users to gain elevated privileges and access sensitive data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20128 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20128.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-20128"
    },
    {
      "cve": "CVE-2026-20129",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, including an API user authentication flaw, allow unauthenticated remote attackers to gain netadmin-level access, escalate privileges to root, access sensitive data, and overwrite arbitrary files in versions prior to 20.18.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20129 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20129.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-20129"
    },
    {
      "cve": "CVE-2026-20133",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager allow unauthenticated remote attackers to access sensitive information, escalate privileges to root, and overwrite arbitrary files via insufficient file system access restrictions in the system\u0027s API.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20133 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20133.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-20133"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-20128"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-257"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-25T17:25:30Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker to gain DCA user privileges on an affected system. To exploit this vulnerability, the attacker must have valid\u0026nbsp;vmanage credentials on the affected system.\n\nThis vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by accessing the filesystem as a low-privileged user and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges.\nNote: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.",
  "id": "GHSA-mp6j-7g85-8pg2",
  "modified": "2026-04-20T21:31:38Z",
  "published": "2026-02-25T18:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20128"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}