Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
CiscoCatalyst SD-WAN Manager
- Exploited in the wild
- In CISA KEV since 20 Apr
- Vendor fix available
Passed 184 days ago
CISA KEV · added 20 Apr
Higher than 94% of scored CVEs
Description NVD
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.
CISA required action
Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Coverage 8 articles · 6 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 5 Mar · 12:29 UTC | SecurityWeek | Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns |
| Thu 5 Mar · 16:41 UTC | The Hacker News | Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN |
| Fri 6 Mar · 10:58 UTC | SOCRadar | Cisco Catalyst SD-WAN Manager (CVE-2026-20122 & CVE-2026-20128) Flaws Exploited |
| Fri 6 Mar · 15:36 UTC | Security Affairs | Cisco warns SDWAN flaws CVE-2026-20128 CVE-2026-20122 |
| Sun 8 Mar · 12:49 UTC | SecurityWeek | Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks |
| Fri 13 Mar · 20:15 UTC | Dark Reading | Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos |
| Tue 21 Apr · 00:32 UTC | CISA | CISA Adds CVE-2026-20128 to Known Exploited Vulnerabilities Catalogue |
| Tue 21 Apr · 00:58 UTC | CISA | Cisco SD-WAN Manager bug exposes passwords to local attackers |
- Cisco SD-WAN Manager bug exposes passwords to local attackersCISA · official notice
- CISA Adds CVE-2026-20128 to Known Exploited Vulnerabilities CatalogueCISA · official notice
- Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN ChaosDark Reading · mentions it in passing
- Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacksSecurityWeek · mentions it in passing
- Cisco warns SDWAN flaws CVE-2026-20128 CVE-2026-20122Security Affairs
- Cisco Catalyst SD-WAN Manager (CVE-2026-20122 & CVE-2026-20128) Flaws ExploitedSOCRadar · mentions it in passing
- Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WANThe Hacker News · mentions it in passing
- Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warnsSecurityWeek · first in our coverage