CVE-2026-20128: Cisco Catalyst SD-WAN Manager

Should you act?

Exploited: patch now if you run it

CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

Yes, if you run Cisco Catalyst SD-WAN Manager. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2026-04-20, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2026-04-23; treat that as the outer limit, not the target.
EPSS 7.2%, percentile 94: FIRST’s model estimates a 7.2% chance of exploitation activity in the next 30 days, higher than 94% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
Needs local access needed. Lower urgency for most teams unless an attacker could already run code on the machine.

What it is

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.

CISA’s summary

Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.

Weakness type: CWE-257.

Product: Cisco Catalyst SD-WAN Manager · Assigned by: cisco · Published: 2026-02-25

Affected and fixed versions

Vendor	Product	Affected versions (per CVE record)
Cisco	Cisco Catalyst SD-WAN Manager	20.1.12, 19.2.1, 18.4.4, 18.4.5, 20.1.1.1, 20.1.1, 19.3.0, 19.2.2, 19.2.099, 18.3.6, 18.3.7, 19.2.0

Severity scores

Scored by	CVSS	Score	Vector
cisco	3.1	7.5 High	`CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H`

Attack vector: local access needed
Attack complexity: high (needs special conditions)
Privileges required: high (admin)
User interaction: none
Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

CISA KEV: added 2026-04-20; federal due date 2026-04-23. Known ransomware use: Unknown.
CISA required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
CISA SSVC assessment: exploitation active, automatable no, technical impact total.
FIRST EPSS (model of 2026-10-21): 7.22% probability of exploitation activity in the next 30 days; percentile 94.

Timeline

2026-02-25 — CVE record published by cisco
2026-04-20 — Added to CISA’s Known Exploited Vulnerabilities catalog
2026-04-21 — CVE record last updated
2026-04-23 — CISA remediation deadline for US federal agencies

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.