---
title: "Cisco SD-WAN Manager CVE-2026-20133/20128: Exploited Chain"
url: https://erroneo.us/security/briefs/cisco-sd-wan-manager-cve-2026-20133-20128-exploit-chain/
description: "SD-WAN Manager file-read and DCA credential leaks, fixed in Feb 2026, were chained by many crews via a public PoC in Mar-Apr. Verify builds; hunt for shells."
type: security-brief
section: "Security Digest"
date_published: 2026-02-25
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-20133", "CVE-2026-20128"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco SD-WAN Manager CVE-2026-20133/20128: Exploited Chain

**Verdict: Check exposure.** A Manager on a February 2026 fixed release or newer is closed to these two bugs, but any Manager that was unpatched and reachable in March or April 2026 should be hunted for web shells, because a public exploit chain was used widely.

- **Who must act:** Operators of on-prem Cisco Catalyst SD-WAN Manager that ran a pre-fix release after early March 2026, or that are still below 20.9.8.2, 20.12.5.3/20.12.6.1, 20.15.4.2 or 20.18.2.1.
- **Who can relax:** Teams that upgraded in February, kept the Manager's web UI and API off the internet, and find nothing in the log checks below.
- **Affected:** SD-WAN Manager earlier than 20.9 (migrate to a fixed release); 20.9 before 20.9.8.2; 20.10 and 20.11 (fixed by moving to 20.12.6.1); 20.12 before 20.12.5.3 or 20.12.6.1; 20.13 to 20.15 before 20.15.4.2; 20.16 and 20.18 before 20.18.2.1 (CVE-2026-20128 does not affect 20.18 and later)
- **Fixed:** 20.9.8.2; 20.12.5.3 or 20.12.6.1; 20.15.4.2; 20.18.2.1; Recommended today, also fixing CVE-2026-76504: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, 26.2.1
- **CVEs:** CVE-2026-20133, CVE-2026-20128
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run show version on each SD-WAN Manager and compare it with Cisco's fixed-release table.
2. Upgrade to the current fixed build for your train, which also covers CVE-2026-76504 (20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 or 26.2.1).
3. Before changing a Manager that was exposed in March-April 2026, collect request admin-tech output and copy /var/log/nms.
4. Hunt the logs below; if you find a web shell or root access, rebuild from fresh images as CISA directs.
5. Rotate the DCA password, admin and API credentials, and any AWS keys the Manager holds.
6. Keep the Manager's web UI and API off the internet and send its logs to an external SIEM.

### How to check if you are affected

- Search /var/log/nms/containers/service-proxy/serviceproxy-access.log for /reports/data/opt/data/containers/config/data-collection-agent/.dca from IPs that are not your administrators (CVE-2026-20128).
- Search the same log for POST /dataservice/smartLicensing/uploadAck and any request to /cmd.gz/cmd.jsp, the web shell endpoint added by the public exploit.
- Check /var/log/nms/vmanage-server.log* for SmartLicensingManager writes with ../ paths into /var/lib/wildfly/standalone/deployments/.
- Look for the web shells, implants, miners and IPs Talos lists, such as sysv.jsp, conf.jsp, systemd-resolved, CWan and /tmp/moneroocean.

## What happened

On February 25, 2026, the day of the CVE-2026-20127 emergency (see [our brief](https://erroneo.us/security/briefs/cisco-catalyst-sd-wan-cve-2026-20127-auth-bypass/)), Cisco also published a [second advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v) fixing five SD-WAN Manager (formerly vManage) bugs found in internal testing. This brief covers two:

- **CVE-2026-20133:** insufficient file system access restrictions let an unauthenticated remote attacker read sensitive files on the underlying OS through the API.
- **CVE-2026-20128:** a credential file for the Data Collection Agent (DCA) user can be read with a crafted HTTP request, giving DCA privileges on other affected systems.

Cisco now rates both CVSS 3.1 7.5. Its March 18 revision redescribed CVE-2026-20128 as remote and unauthenticated; CISA's KEV text still calls it local and authenticated. The CVE records ([20133](https://www.cve.org/CVERecord?id=CVE-2026-20133), [20128](https://www.cve.org/CVERecord?id=CVE-2026-20128)) still carry older vectors. NVD scores [20133](https://nvd.nist.gov/vuln/detail/CVE-2026-20133) 7.5 and lists only Cisco's older score for [20128](https://nvd.nist.gov/vuln/detail/CVE-2026-20128).

Cisco reported exploitation of CVE-2026-20128 and its sibling CVE-2026-20122, an authenticated file overwrite, on March 5. It added CVE-2026-20133 on April 22. CISA added all three to KEV ([20133](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20133), [20128](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128)) on April 20 with a three-day deadline. It pointed to [ED 26-03](https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems) and its [hunt and hardening supplement](https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems).

[Cisco Talos](https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/) explains the wave. In March, ZeroZenX Labs published proof-of-concept code chaining CVE-2026-20133, CVE-2026-20128 and CVE-2026-20122, mislabeled as CVE-2026-20127. The chain lets a remote, unauthenticated attacker in and drops a JSP web shell Talos calls XenShell. From March to April, Talos saw "widespread" exploitation by ten clusters unrelated to UAT-8616, which deployed Godzilla and Behinder shells, AdaptixC2 and Sliver implants, XMRig miners and gsocket tunnels. One script tried to steal the admin hash, JWT key material and the Manager's AWS credentials.

## Who is affected

On-prem SD-WAN Manager in any configuration below 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2 and 20.18.2.1. Releases before 20.9, and 20.10, 20.11, 20.13, 20.14 and 20.16, must move to another train. CVE-2026-20128 does not affect 20.18 and later.

## Do you really need to act?

Check, then hunt. These fixes are eight months old, and the builds for the September CVE-2026-76504 bypass ([our brief](https://erroneo.us/security/briefs/cisco-sd-wan-manager-cve-2026-76504-api-auth-bypass/)) include them. Talos dates the earliest activity to March 3, using a public, ready-made chain. Any Manager that was unpatched and reachable after that may still hold a web shell or implant. Patching closes the bugs; it does not prove the box is clean. Anything still on a pre-February release: upgrade today and treat it as exposed.

## What to do now

1. Run `show version` on each Manager and compare it with Cisco's table.
2. Upgrade to the current build for your train. The [CVE-2026-76504 advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU) lists 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1.
3. On a Manager exposed in March or April 2026, first collect `request admin-tech` output and copy `/var/log/nms`.
4. Rotate the DCA password, admin and API credentials, and any cloud keys on the box. If you find a shell or root access, rebuild from fresh images, as CISA's supplement directs.

## How to tell if you were hit

Cisco's indicators live in `/var/log/nms/containers/service-proxy/serviceproxy-access.log`. Run `zgrep -E 'data-collection-agent/\.dca|smartLicensing/uploadAck|cmd\.gz/cmd\.jsp' /var/log/nms/containers/service-proxy/serviceproxy-access.log*`. A `.dca` read from an address that is not an administrator's points to CVE-2026-20128. Any hit on `/cmd.gz/cmd.jsp`, an endpoint absent on a clean system, means the public exploit ran. In `/var/log/nms/vmanage-server.log*`, SmartLicensingManager lines writing `../` paths into `/var/lib/wildfly/standalone/deployments/` are another sign. Cisco gives no log signature specific to CVE-2026-20133. Talos lists shells such as `sysv.jsp` and `conf.jsp`, implants named `systemd-resolved` and `CWan`, miners under `/tmp/moneroocean`, and attacker IPs.

## Timeline

- Feb 25, 2026 — Cisco publishes the advisory and fixes.
- Mar 3, 2026 — Earliest exploitation of the chain Talos has seen.
- Mar 5, 2026 — Cisco reports exploitation of CVE-2026-20128 and CVE-2026-20122.
- Mar 18, 2026 — Cisco revises the CVE-2026-20128 details and adds indicators.
- Apr 20, 2026 — CISA adds CVE-2026-20133, CVE-2026-20128 and CVE-2026-20122 to KEV.
- Apr 22, 2026 — Cisco reports exploitation of CVE-2026-20133.
- May 14, 2026 — Talos publishes its analysis of the exploitation clusters.

## Sources

1. [Cisco — Cisco Catalyst SD-WAN Vulnerabilities (cisco-sa-sdwan-authbp-qwCX8D4v)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v)
2. [Cisco — Catalyst SD-WAN Manager API Authentication Bypass Vulnerability (cisco-sa-sdwan-webauth-xr8beuuU)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU)
3. [CVE record — CVE-2026-20133](https://www.cve.org/CVERecord?id=CVE-2026-20133)
4. [CVE record — CVE-2026-20128](https://www.cve.org/CVERecord?id=CVE-2026-20128)
5. [NVD — CVE-2026-20133](https://nvd.nist.gov/vuln/detail/CVE-2026-20133)
6. [NVD — CVE-2026-20128](https://nvd.nist.gov/vuln/detail/CVE-2026-20128)
7. [CISA — Known Exploited Vulnerabilities: CVE-2026-20133](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20133)
8. [CISA — Known Exploited Vulnerabilities: CVE-2026-20128](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128)
9. [CISA — ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems](https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems)
10. [CISA — Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems](https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems)
11. [Cisco Talos — Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities](https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/)

---
Source page: https://erroneo.us/security/briefs/cisco-sd-wan-manager-cve-2026-20133-20128-exploit-chain/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt