erroneo.us
Search all guides⌘K

Security Digest · Feb 25, 2026 · Vulnerability · Network edge

Cisco SD-WAN Manager CVE-2026-20133/20128: Exploited Chain

SD-WAN Manager file-read and DCA credential leaks, fixed in Feb 2026, were chained by many crews via a public PoC in Mar-Apr. Verify builds; hunt for shells.

Published By erroneo.us Security Desk · Updated 3 min read11 sources

Our verdict

Check exposure

A Manager on a February 2026 fixed release or newer is closed to these two bugs, but any Manager that was unpatched and reachable in March or April 2026 should be hunted for web shells, because a public exploit chain was used widely.

Who must act: Operators of on-prem Cisco Catalyst SD-WAN Manager that ran a pre-fix release after early March 2026, or that are still below 20.9.8.2, 20.12.5.3/20.12.6.1, 20.15.4.2 or 20.18.2.1.

Who can relax: Teams that upgraded in February, kept the Manager's web UI and API off the internet, and find nothing in the log checks below.

Affected
SD-WAN Manager earlier than 20.9 (migrate to a fixed release)
20.9 before 20.9.8.2
20.10 and 20.11 (fixed by moving to 20.12.6.1)
20.12 before 20.12.5.3 or 20.12.6.1
20.13 to 20.15 before 20.15.4.2
20.16 and 20.18 before 20.18.2.1 (CVE-2026-20128 does not affect 20.18 and later)
Fixed in
20.9.8.2
20.12.5.3 or 20.12.6.1
20.15.4.2
20.18.2.1
Recommended today, also fixing CVE-2026-76504: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, 26.2.1
CVSS
7.5 (v3.1, vendor)
EPSS
31.5% (percentile 98)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Run show version on each SD-WAN Manager and compare it with Cisco's fixed-release table.
  2. Upgrade to the current fixed build for your train, which also covers CVE-2026-76504 (20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 or 26.2.1).
  3. Before changing a Manager that was exposed in March-April 2026, collect request admin-tech output and copy /var/log/nms.
  4. Hunt the logs below; if you find a web shell or root access, rebuild from fresh images as CISA directs.
  5. Rotate the DCA password, admin and API credentials, and any AWS keys the Manager holds.
  6. Keep the Manager's web UI and API off the internet and send its logs to an external SIEM.

How to check if you are affected or compromised

  • Search /var/log/nms/containers/service-proxy/serviceproxy-access.log for /reports/data/opt/data/containers/config/data-collection-agent/.dca from IPs that are not your administrators (CVE-2026-20128).
  • Search the same log for POST /dataservice/smartLicensing/uploadAck and any request to /cmd.gz/cmd.jsp, the web shell endpoint added by the public exploit.
  • Check /var/log/nms/vmanage-server.log* for SmartLicensingManager writes with ../ paths into /var/lib/wildfly/standalone/deployments/.
  • Look for the web shells, implants, miners and IPs Talos lists, such as sysv.jsp, conf.jsp, systemd-resolved, CWan and /tmp/moneroocean.

What happened#

On February 25, 2026, the day of the CVE-2026-20127 emergency (see our brief), Cisco also published a second advisory fixing five SD-WAN Manager (formerly vManage) bugs found in internal testing. This brief covers two:

  • CVE-2026-20133: insufficient file system access restrictions let an unauthenticated remote attacker read sensitive files on the underlying OS through the API.
  • CVE-2026-20128: a credential file for the Data Collection Agent (DCA) user can be read with a crafted HTTP request, giving DCA privileges on other affected systems.

Cisco now rates both CVSS 3.1 7.5. Its March 18 revision redescribed CVE-2026-20128 as remote and unauthenticated; CISA's KEV text still calls it local and authenticated. The CVE records (20133, 20128) still carry older vectors. NVD scores 20133 7.5 and lists only Cisco's older score for 20128.

Cisco reported exploitation of CVE-2026-20128 and its sibling CVE-2026-20122, an authenticated file overwrite, on March 5. It added CVE-2026-20133 on April 22. CISA added all three to KEV (20133, 20128) on April 20 with a three-day deadline. It pointed to ED 26-03 and its hunt and hardening supplement.

Cisco Talos explains the wave. In March, ZeroZenX Labs published proof-of-concept code chaining CVE-2026-20133, CVE-2026-20128 and CVE-2026-20122, mislabeled as CVE-2026-20127. The chain lets a remote, unauthenticated attacker in and drops a JSP web shell Talos calls XenShell. From March to April, Talos saw "widespread" exploitation by ten clusters unrelated to UAT-8616, which deployed Godzilla and Behinder shells, AdaptixC2 and Sliver implants, XMRig miners and gsocket tunnels. One script tried to steal the admin hash, JWT key material and the Manager's AWS credentials.

Who is affected#

On-prem SD-WAN Manager in any configuration below 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2 and 20.18.2.1. Releases before 20.9, and 20.10, 20.11, 20.13, 20.14 and 20.16, must move to another train. CVE-2026-20128 does not affect 20.18 and later.

Do you really need to act?#

Check, then hunt. These fixes are eight months old, and the builds for the September CVE-2026-76504 bypass (our brief) include them. Talos dates the earliest activity to March 3, using a public, ready-made chain. Any Manager that was unpatched and reachable after that may still hold a web shell or implant. Patching closes the bugs; it does not prove the box is clean. Anything still on a pre-February release: upgrade today and treat it as exposed.

What to do now#

  1. Run show version on each Manager and compare it with Cisco's table.
  2. Upgrade to the current build for your train. The CVE-2026-76504 advisory lists 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1.
  3. On a Manager exposed in March or April 2026, first collect request admin-tech output and copy /var/log/nms.
  4. Rotate the DCA password, admin and API credentials, and any cloud keys on the box. If you find a shell or root access, rebuild from fresh images, as CISA's supplement directs.

How to tell if you were hit#

Cisco's indicators live in /var/log/nms/containers/service-proxy/serviceproxy-access.log. Run zgrep -E 'data-collection-agent/\.dca|smartLicensing/uploadAck|cmd\.gz/cmd\.jsp' /var/log/nms/containers/service-proxy/serviceproxy-access.log*. A .dca read from an address that is not an administrator's points to CVE-2026-20128. Any hit on /cmd.gz/cmd.jsp, an endpoint absent on a clean system, means the public exploit ran. In /var/log/nms/vmanage-server.log*, SmartLicensingManager lines writing ../ paths into /var/lib/wildfly/standalone/deployments/ are another sign. Cisco gives no log signature specific to CVE-2026-20133. Talos lists shells such as sysv.jsp and conf.jsp, implants named systemd-resolved and CWan, miners under /tmp/moneroocean, and attacker IPs.

Timeline#

  • — Cisco publishes the advisory and fixes.
  • — Earliest exploitation of the chain Talos has seen.
  • — Cisco reports exploitation of CVE-2026-20128 and CVE-2026-20122.
  • — Cisco revises the CVE-2026-20128 details and adds indicators.
  • — CISA adds CVE-2026-20133, CVE-2026-20128 and CVE-2026-20122 to KEV.
  • — Cisco reports exploitation of CVE-2026-20133.
  • — Talos publishes its analysis of the exploitation clusters.

Vulnerability records

  • CVE-2026-20133 · KEV 2026-04-20 · A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system.
  • CVE-2026-20128 · KEV 2026-04-20 · A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Cisco — Cisco Catalyst SD-WAN Vulnerabilities (cisco-sa-sdwan-authbp-qwCX8D4v) sec.cloudapps.cisco.com
  2. Cisco — Catalyst SD-WAN Manager API Authentication Bypass Vulnerability (cisco-sa-sdwan-webauth-xr8beuuU) sec.cloudapps.cisco.com
  3. CVE record — CVE-2026-20133 cve.org
  4. CVE record — CVE-2026-20128 cve.org
  5. NVD — CVE-2026-20133 nvd.nist.gov
  6. NVD — CVE-2026-20128 nvd.nist.gov
  7. CISA — Known Exploited Vulnerabilities: CVE-2026-20133 cisa.gov
  8. CISA — Known Exploited Vulnerabilities: CVE-2026-20128 cisa.gov
  9. CISA — ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems cisa.gov
  10. CISA — Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems cisa.gov
  11. Cisco Talos — Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities blog.talosintelligence.com