CVE
CVE-2022-20775
Cisco · Cisco Catalyst SD-WAN; Cisco · Cisco Catalyst SD-WAN Manager; +3 more
- First Reported
- Mar 5, 2026
- Latest Reported
- May 15, 2026
CVE Enrichment
- CVSS
- 7.8 HIGH
- EPSS
- 12.48%
- EPSS Percentile
- 96.22%
- CISA KEV
- YES — Known Exploited Vulnerability
Description
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- [email protected]
- Published
- 01-Oct-2022 02:15
- Last Modified
- 17-Jun-2026 11:25
- EPSS Date
- 2026-11-02
- CWE
- CWE-25, CWE-22
CVSS Vector
CVSS:3.1 AV:L /
AC:L /
PR:L /
UI:N /
S:U /
C:H /
I:H /
A:H
CISA KEV Details
- Date Added
- 2026-02-25
- Remediation Due
- 2026-02-27
- Known Ransomware Campaign Use
- Unknown
- Required Action
- Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
- Notes
- CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html ; https://nvd.nist.gov/vuln/detail/CVE-2022-20775
CNA Products / Version Status
- Cisco · Cisco Catalyst SD-WAN Manager
Source: CNA · [email protected]
Default status: unknown
20.1.12 — affected
19.2.1 — affected
18.4.4 — affected
18.4.5 — affected
20.1.1.1 — affected
20.1.1 — affected
19.3.0 — affected
19.2.2 — affected
19.2.099 — affected
18.3.6 — affected
18.3.7 — affected
19.2.0 — affected
18.3.8 — affected
19.0.0 — affected
19.1.0 — affected
18.4.302 — affected
18.4.303 — affected
19.2.097 — affected
19.2.098 — affected
17.2.10 — affected
18.3.6.1 — affected
19.0.1a — affected
18.2.0 — affected
18.4.3 — affected
18.4.1 — affected
17.2.8 — affected
18.3.3.1 — affected
18.4.0 — affected
18.3.1 — affected
17.2.6 — affected
17.2.9 — affected
18.3.4 — affected
17.2.5 — affected
18.3.1.1 — affected
18.3.5 — affected
18.4.0.1 — affected
18.3.3 — affected
17.2.7 — affected
17.2.4 — affected
18.3.0 — affected
19.2.3 — affected
18.4.501_ES — affected
20.3.1 — affected
20.1.2 — affected
19.2.929 — affected
19.2.31 — affected
20.3.2 — affected
19.2.32 — affected
20.3.2_925 — affected
20.3.2.1 — affected
20.3.2.1_927 — affected
18.4.6 — affected
20.1.2_937 — affected
20.4.1 — affected
20.3.2_928 — affected
20.3.2_929 — affected
20.4.1.0.1 — affected
20.3.2.1_930 — affected
19.2.4 — affected
20.5.0.1.1 — affected
20.4.1.1 — affected
20.3.3 — affected
19.2.4.0.1 — affected
20.3.2_937 — affected
20.3.3.1 — affected
20.5.1 — affected
20.1.3 — affected
20.3.3.0.4 — affected
20.3.3.1.2 — affected
20.3.3.1.1 — affected
20.4.1.2 — affected
20.3.3.0.2 — affected
20.4.1.1.5 — affected
20.4.1.0.01 — affected
20.4.1.0.02 — affected
20.3.3.1.7 — affected
20.3.3.1.5 — affected
20.5.1.0.1 — affected
20.3.3.1.10 — affected
20.3.3.0.8 — affected
20.4.2 — affected
20.4.2.0.1 — affected
20.3.4 — affected
20.3.3.0.14 — affected
19.2.4.0.8 — affected
19.2.4.0.9 — affected
20.3.4.0.1 — affected
20.3.2.0.5 — affected
20.6.1 — affected
20.5.1.0.2 — affected
20.3.3.0.17 — affected
20.6.1.1 — affected
20.6.0.18.3 — affected
20.3.2.0.6 — affected
20.6.0.18.4 — affected
20.4.2.0.2 — affected
20.3.3.0.16 — affected
20.3.4.0.5 — affected
20.6.1.0.1 — affected
20.3.4.0.6 — affected
20.6.2 — affected
20.7.1EFT2 — affected
20.3.4.0.9 — affected
20.3.4.0.11 — affected
20.4.2.0.4 — affected
20.3.3.0.18 — affected
20.7.1 — affected
20.6.2.1 — affected
20.3.4.1 — affected
20.5.1.1 — affected
20.4.2.1 — affected
20.4.2.1.1 — affected
20.3.4.1.1 — affected
20.3.813 — affected
20.3.4.0.19 — affected
20.4.2.2.1 — affected
20.5.1.2 — affected
20.3.4.2 — affected
20.3.814 — affected
20.4.2.2 — affected
20.6.2.2 — affected
20.3.4.2.1 — affected
20.7.1.1 — affected
20.3.4.1.2 — affected
20.6.2.2.2 — affected
20.3.4.0.20 — affected
20.6.2.2.3 — affected
20.4.2.2.2 — affected
20.3.5 — affected
20.6.2.0.4 — affected
20.4.2.2.3 — affected
20.3.4.0.24 — affected
20.6.2.2.7 — affected
20.6.3 — affected
20.3.4.2.2 — affected
20.4.2.2.4 — affected
20.7.1.0.2 — affected
20.3.5.0.8 — affected
20.3.5.0.9 — affected
20.3.5.0.7 — affected
20.3.6 — affected
20.3.7 — affected
20.3.5.1 — affected
20.3.4.3 — affected
20.3.3.2 — affected
20.3.7.1 — affected
20.3.4.0.25 — affected
20.6.2.2.4 — affected
20.6.1.2 — affected
20.3.4.0.26 — affected
20.3.7.2 — affected
20.3.8 — affected
- Cisco · Cisco Catalyst SD-WAN
Source: CNA · [email protected]
Default status: unknown
18.3.1 — affected
19.2.1 — affected
17.2.4 — affected
19.3.0 — affected
18.3.0 — affected
18.3.4 — affected
18.4.303 — affected
18.4.0.1 — affected
17.2.9 — affected
18.3.7 — affected
18.2.0 — affected
17.2.10 — affected
18.4.5 — affected
18.4.0 — affected
17.2.5 — affected
18.3.8 — affected
18.4.4 — affected
18.4.302 — affected
17.2.7 — affected
19.2.098 — affected
20.1.1 — affected
19.2.099 — affected
18.3.3 — affected
18.4.1 — affected
17.2.8 — affected
18.3.5 — affected
19.0.0 — affected
18.4.3 — affected
19.1.0 — affected
17.2.6 — affected
18.3.3.1 — affected
19.2.097 — affected
20.1.1.1 — affected
18.3.6 — affected
19.2.0 — affected
19.2.2 — affected
20.1.11 — affected
20.1.12 — affected
19.1.0a — affected
19.2.3 — affected
17.3.1ESM1 — affected
20.3.1 — affected
17.3.1ESM2 — affected
17.2.1LA — affected
20.1.2 — affected
17.3.1ESM3 — affected
19.2.929 — affected
19.2.31 — affected
20.3.2 — affected
19.2.32 — affected
17.3.2ESM1 — affected
20.3.2.1 — affected
18.4.6 — affected
20.4.1 — affected
17.3.2ESM2 — affected
19.2.4 — affected
20.4.1.1 — affected
20.3.3 — affected
20.3.809 — affected
20.3.3.1 — affected
20.5.1 — affected
20.3.811 — affected
20.1.3 — affected
20.4.1.2 — affected
17.4.2.2527 — affected
17.4.2ES1 — affected
17.3.2ESM3 — affected
20.4.2 — affected
20.3.4 — affected
20.6.1 — affected
20.6.1.1 — affected
20.6.2 — affected
20.7.1 — affected
20.4.2.1 — affected
20.3.4.1 — affected
20.5.1.1 — affected
20.6.2.1 — affected
20.3.4.2 — affected
20.4.2.2 — affected
20.6.2.2 — affected
20.5.1.2 — affected
20.7.1.1 — affected
20.3.5 — affected
20.6.3 — affected
20.7.2 — affected
20.6.3.1 — affected
20.6.4 — affected
20.3.6 — affected
20.6.5 — affected
20.3.7 — affected
20.6.5.1 — affected
20.6.4.1 — affected
20.6.3.2 — affected
20.4.2.3 — affected
20.6.1.2 — affected
20.3.4.3 — affected
20.6.5.2 — affected
20.3.3.2 — affected
20.3.7.1 — affected
20.3.5.1 — affected
20.1.3.1 — affected
20.6.5.3 — affected
20.6.3.3 — affected
20.3.7.2 — affected
20.6.5.4 — affected
20.6.4.2 — affected
20.6.5.5 — affected
20.6.3.4 — affected
20.3.8 — affected
20.6.6 — affected
20.6.7 — affected
20.6.8 — affected
- Cisco · Cisco SD-WAN vContainer
Source: CNA · [email protected]
Default status: unknown
18.4.5 — affected
20.1.12 — affected
18.3.6 — affected
19.2.1 — affected
19.3.0 — affected
20.1.1 — affected
19.2.2 — affected
18.3.8 — affected
18.4.3 — affected
18.4.4 — affected
18.4.302 — affected
19.1.0 — affected
18.4.303 — affected
19.2.0 — affected
19.2.098 — affected
17.2.10 — affected
18.3.7 — affected
18.3.1 — affected
19.2.099 — affected
19.2.097 — affected
18.3.4 — affected
18.2.0 — affected
18.3.5 — affected
18.4.1 — affected
17.2.5 — affected
17.2.7 — affected
17.2.8 — affected
17.2.9 — affected
18.4.0 — affected
17.2.6 — affected
18.3.0 — affected
17.2.4 — affected
18.3.3 — affected
19.2.3 — affected
20.3.1 — affected
20.1.2 — affected
- Cisco · Cisco SD-WAN vEdge Cloud
Source: CNA · [email protected]
Default status: unknown
19.2.1 — affected
20.1.12 — affected
18.4.4 — affected
19.3.0 — affected
18.3.8 — affected
19.2.2 — affected
20.1.1 — affected
18.3.6 — affected
18.4.3 — affected
18.4.302 — affected
18.4.5 — affected
18.4.303 — affected
19.2.098 — affected
19.1.0 — affected
17.2.10 — affected
19.0.1a — affected
19.2.099 — affected
18.3.7 — affected
19.2.097 — affected
18.3.1 — affected
19.2.0 — affected
17.2.9 — affected
18.3.4 — affected
18.2.0 — affected
18.4.1 — affected
17.2.5 — affected
18.4.0 — affected
18.3.5 — affected
18.3.3 — affected
17.2.7 — affected
17.2.6 — affected
17.2.8 — affected
18.3.0 — affected
17.2.4 — affected
19.2.3 — affected
20.3.1 — affected
20.1.2 — affected
19.2.929 — affected
19.2.31 — affected
20.3.2 — affected
19.2.32 — affected
18.4.6 — affected
20.4.1 — affected
19.2.4 — affected
20.4.1.1 — affected
20.3.3 — affected
20.5.1 — affected
20.1.3 — affected
20.4.1.2 — affected
20.4.2 — affected
20.3.4 — affected
20.6.1 — affected
20.6.2 — affected
20.7.1 — affected
20.3.5 — affected
20.6.3 — affected
20.7.2 — affected
20.6.4 — affected
20.3.6 — affected
20.6.5 — affected
20.3.7 — affected
20.4.2.3 — affected
20.3.4.3 — affected
20.6.4.1 — affected
20.6.3.2 — affected
20.3.5.1 — affected
20.6.5.2 — affected
20.3.7.1 — affected
20.3.3.2 — affected
20.6.1.2 — affected
20.1.3.1 — affected
20.6.5.3 — affected
20.6.3.3 — affected
20.3.7.2 — affected
20.6.5.4 — affected
20.3.8 — affected
20.6.6 — affected
20.6.7 — affected
20.6.8 — affected
- Cisco · Cisco SD-WAN vEdge Router
Source: CNA · [email protected]
Default status: unknown
18.4.303 — affected
18.3.7 — affected
19.3.0 — affected
18.2.0 — affected
20.1.12 — affected
19.2.099 — affected
17.2.10 — affected
18.3.3 — affected
18.3.6 — affected
19.0.0 — affected
17.2.6 — affected
18.4.0 — affected
19.1.01 — affected
19.2.098 — affected
18.3.1 — affected
18.4.302 — affected
19.2.2 — affected
18.3.5 — affected
17.2.9 — affected
19.1.0 — affected
20.1.11 — affected
19.2.097 — affected
18.4.5 — affected
17.2.5 — affected
17.2.8 — affected
18.3.8 — affected
18.3.0 — affected
18.4.3 — affected
18.4.4 — affected
19.2.1 — affected
17.2.4 — affected
18.3.4 — affected
19.0.1a — affected
20.1.1 — affected
17.2.7 — affected
18.4.1 — affected
19.2.0 — affected
19.2.3 — affected
20.3.1 — affected
20.1.2 — affected
19.2.929 — affected
19.2.31 — affected
20.3.2 — affected
19.2.32 — affected
18.4.6 — affected
20.4.1 — affected
19.2.4 — affected
20.4.1.1 — affected
20.3.3 — affected
20.5.1 — affected
20.1.3 — affected
20.4.1.2 — affected
20.4.2 — affected
20.3.4 — affected
20.6.1 — affected
20.6.2 — affected
20.7.1 — affected
20.7.1.2 — affected
20.3.5 — affected
20.6.3 — affected
20.7.2 — affected
20.6.4 — affected
20.3.6 — affected
20.6.5 — affected
20.3.7 — affected
20.6.5.1 — affected
20.3.3.2 — affected
20.6.4.1 — affected
20.6.3.2 — affected
20.3.4.3 — affected
20.6.5.2 — affected
20.3.7.1 — affected
20.3.5.1 — affected
20.6.1.2 — affected
20.6.5.3 — affected
20.6.3.3 — affected
20.3.7.2 — affected
20.6.5.4 — affected
20.3.8 — affected
20.6.6 — affected
20.6.7 — affected
20.6.8 — affected
Affected Products / Versions
- cisco / catalyst_sd-wan_manager
Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 20.6.3
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* - cisco / catalyst_sd-wan_manager
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.7 · before (exclusive) 20.7.2
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* - cisco / catalyst_sd-wan_manager
Source: NVD CPE · affected
Version / affected range: 20.8
cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.8:*:*:*:*:*:*:* - cisco / sd-wan_vbond_orchestrator
Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 20.6.3
cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:* - cisco / sd-wan_vbond_orchestrator
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.7 · before (exclusive) 20.7.2
cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:* - cisco / sd-wan_vbond_orchestrator
Source: NVD CPE · affected
Version / affected range: 20.8
cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:20.8:*:*:*:*:*:*:* - cisco / sd-wan_vedge_cloud
Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 20.6.3
cpe:2.3:a:cisco:sd-wan_vedge_cloud:*:*:*:*:*:*:*:* - cisco / sd-wan_vedge_cloud
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.7 · before (exclusive) 20.7.2
cpe:2.3:a:cisco:sd-wan_vedge_cloud:*:*:*:*:*:*:*:* - cisco / sd-wan_vedge_cloud
Source: NVD CPE · affected
Version / affected range: 20.8
cpe:2.3:a:cisco:sd-wan_vedge_cloud:20.8:*:*:*:*:*:*:* - cisco / sd-wan_vsmart_controller
Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 20.6.3
cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* - cisco / sd-wan_vsmart_controller
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.7 · before (exclusive) 20.7.2
cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:* - cisco / sd-wan_vsmart_controller
Source: NVD CPE · affected
Version / affected range: 20.8
cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.8:*:*:*:*:*:*:* - cisco / sd-wan
Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 20.6.3
cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:* - cisco / sd-wan
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.7 · before (exclusive) 20.7.2
cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:* - cisco / sd-wan
Source: NVD CPE · affected
Version / affected range: 20.8
cpe:2.3:a:cisco:sd-wan:20.8:*:*:*:*:*:*:*
References
- [email protected]
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- CISA Advisory
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (3)
- The first time UAT-8616 exploited a Catalyst authentication bypass bug, it took advantage of its access to exploit an older vulnerability, CVE-2022-20775, and escalate from privileged to outright root access. Cisco SD-WAN Authentication Bypass CVE-2026-20182 Exploited in the Wild
- agencies reported that CVE-2026-20127 has been chained with an older Catalyst vulnerability, CVE-2022-20775, to bypass authentication, escalate privileges, and establish persistence on the targeted system. Cisco Warns of Active Exploitation of Two Catalyst SD-WAN Flaws
- potential compromises tied to attacks targeting CVE-2026-20127 and an older flaw tracked as CVE-2022-20775. Cisco Warns Two More SD-WAN Flaws Are Actively Exploited
CVE (6)
People (2)
Threat Actors (2)
MITRE ATT&CK (2)
Vendors (1)
Products (3)
Industries (1)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.