CVE-2026-20128

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 7.32%
EPSS Percentile: 94.38%
CISA KEV: YES — Known Exploited Vulnerability

Description

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 26-Feb-2026 00:25
Last Modified: 17-Jun-2026 17:17
EPSS Date: 2026-11-01
CWE: CWE-257

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:H /
                            PR:H /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2026-04-20
Remediation Due: 2026-04-23
Known Ransomware Campaign Use: Unknown
Required Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Notes: CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ; https://nvd.nist.gov/vuln/detail/CVE-2026-20128

Affected Products / Versions

cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 20.9.8.2
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.10 · before (exclusive) 20.12.5.3
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.13 · before (exclusive) 20.15.4.2
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.16 · before (exclusive) 20.18
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: 20.12.6
cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*

References

Last enrichment sync: 02-Nov-2026 20:10
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (6)

[CVE IDs] Additional actively exploited network-facing flaws observed by Proofpoint – CVE-2026-20122, CVE-2026-20128, and 2 more CVEs Proofpoint Observes 12 2026 CVEs in Exploitation, Four Not on CISA KEV
company previously disclosed and released patches for the vulnerabilities — including CVE-2026-20122, CVE-2026-20128 and CVE-2026-20133 — in February. Cisco Warns of Ongoing Exploitation of SD-WAN Zero-Day CVE-2026-20182
with the cybersecurity company also observing multiple threat clusters exploiting CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 beginning March 2026. CISA Adds Cisco SD-WAN Authentication Bypass to KEV After Active Exploitation
One week later, the company revealed that two other security flaws it had patched the same day (CVE-2026-20128 and CVE-2026-20122)were being exploited in the wild. CISA Flags Cisco SD-WAN Flaw as Actively Exploited, Orders Agencies to Patch
CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133: Three distinct vulnerabilities impacting Cisco Catalyst SD-WAN Manager, ranging from privilege escalation to exposure of sensitive information. CISA Adds Eight Actively Exploited Vulnerabilities to KEV Catalog

CVE (16)

Malware (8)

People (2)

Threat Actors (8)

MITRE ATT&CK (16)

Vendors (11)

Products (17)

Tools (4)

Industries (4)

Countries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.