Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2026-20128

HighExploitedPublic exploit

Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability

Published Feb 25, 2026 · Updated Apr 21, 2026

Key Facts

Patch immediately
  • CVE-2026-20128 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Catalyst SD-WAN Manager (Cisco).
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Mar 5, 2026. Public exploit code is available.
  • EPSS estimates a 7.2% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Catalyst SD-WAN Manager 20.9.8.2.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

7.5

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

7.2%

Higher than 94.2% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2026-20128 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system.

This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVApr 20, 2026Apr 23, 2026Not reported
Industry KEV feedMar 5, 2026Apr 23, 2026Not reported
CIRCL KEVMar 6, 2026Apr 23, 2026Not reported
ENISA EUVDApr 20, 2026n/aNot reported

Required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Affected Products

3 affected entries in total
ProductAffected versionsFixed in
Catalyst SD-WAN ManagerCisco20.12.6, >= 20.1.1220.9.8.2

Patched Releases

Catalyst SD-WAN Manager

20.9.8.2

Timeline

  1. Publicly disclosed

    Feb 25, 2026

  2. Added to Industry KEV feed

    Mar 5, 2026

  3. Added to CIRCL KEV

    Mar 6, 2026

  4. Added to CISA KEV

    Apr 20, 2026

  5. Added to ENISA EUVD

    Apr 20, 2026

  6. Last updated

    Apr 21, 2026

Weakness Type

  • CWE-257 Storing Passwords in a Recoverable Format

References

6 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2026-20128 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo