CVE-2026-20128
Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
- Published
- Updated
- Reserved
- Assigned by
- cisco
Description
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.
Exploited in the wild
CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability.
- Added
- 20 Apr 2026
- Fix due (US federal)
- 23 Apr 2026
- Used by ransomware
- Not known
Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ciscoCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | High7.5 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 8.3% · top 5.0% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: active · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
Cisco · Cisco Catalyst SD-WAN Manager
- affected 20.1.12
- affected 19.2.1
- affected 18.4.4
- affected 18.4.5
- affected 20.1.1.1
- affected 20.1.1
- affected 19.3.0
- affected 19.2.2
- affected 19.2.099
- affected 18.3.6
- affected 18.3.7
- affected 19.2.0
- affected 18.3.8
- affected 19.0.0
- affected 19.1.0
- affected 18.4.302
- affected 18.4.303
- affected 19.2.097
- affected 19.2.098
- affected 17.2.10
- affected 18.3.6.1
- affected 19.0.1a
- affected 18.2.0
- affected 18.4.3
- affected 18.4.1
- affected 17.2.8
- affected 18.3.3.1
- affected 18.4.0
- affected 18.3.1
- affected 17.2.6
- affected 17.2.9
- affected 18.3.4
- affected 17.2.5
- affected 18.3.1.1
- affected 18.3.5
- affected 18.4.0.1
- affected 18.3.3
- affected 17.2.7
- affected 18.3.0
- affected 19.2.3
- and 96 more
What to do
Exploitation: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in CVE-2026-20133, CVE-2026-20126, and CVE-2026-20129. In March 2026, the Cisco PSIRT became aware of active exploitation of the vulnerabilities that are described in CVE-2026-20128 and CVE-2026-20122 only. The vulnerabilities that are described in the other CVEs in this advisory are not known to have been compromised. Cisco strongly recommends that customers upgrade to a fixed software release to remediate these vulnerabilities.
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- CISA KEV catalog (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-20128)Record last updated .