CISA
Cisco SD-WAN flaw leaks data, CISA urges urgent patching
According to CISA, the KEV entry for CVE-2026-20133 concerns Cisco Catalyst SD-WAN Manager, a vulnerability described as an exposure of sensitive information to an unauthorised actor that could allow remote attackers to view sensitive information on affected systems. It is linked to CWE-200 and is currently marked as Unknown regarding being used in ransomware campaigns. The record shows an entry date of 20 April 2026 and a due date of 23 April 2026.
The page directs readers to CISA mitigation instructions and related hunt and hardening guidance for Cisco SD-WAN devices, with additional references to Cisco security advisories and the NVD entry for the CVE. The KEV Catalog provides CSV, JSON, and JSON Schema formats for download, along with a Print View and explanatory notes.
Story timeline CVE-2026-20133
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 13 Mar · 20:15 UTC | Dark Reading | Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos |
| Tue 21 Apr · 00:22 UTC | CISA | Cisco SDWAN flaw leaks data, CISA orders patch by April 2026 |
| Tue 21 Apr · 00:58 UTC | CISA | Cisco SD-WAN flaw leaks data, CISA urges urgent patching (this article) |
| Tue 21 Apr · 10:21 UTC | Security Affairs | CISA adds weaponised PaperCut, TeamCity flaws to KEV catalog |
| Tue 21 Apr · 11:31 UTC | SecurityWeek | CISA Adds Cisco SD WAN, Zimbra XSS Flaws to KEV Catalog |