CVE-2026-20133

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 31.48%
EPSS Percentile: 98.28%
CISA KEV: YES — Known Exploited Vulnerability

Description

A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 26-Feb-2026 00:25
Last Modified: 17-Jun-2026 17:17
EPSS Date: 2026-11-01
CWE: CWE-200

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:N /
                            A:N

CISA KEV Details

Date Added: 2026-04-20
Remediation Due: 2026-04-23
Known Ransomware Campaign Use: Unknown
Required Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Notes: CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ; https://nvd.nist.gov/vuln/detail/CVE-2026-20133

Affected Products / Versions

cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 20.9.8.2
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.10 · before (exclusive) 20.12.5.3
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.13 · before (exclusive) 20.15.4.2
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.16 · before (exclusive) 20.18.2.1
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: 20.12.6
cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*

References

Last enrichment sync: 02-Nov-2026 20:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (7)

Three CVEs in our network telemetry affect Cisco Catalyst SD-WAN infrastructure: CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133. Proofpoint Observes 12 2026 CVEs in Exploitation, Four Not on CISA KEV
disclosed and released patches for the vulnerabilities — including CVE-2026-20122, CVE-2026-20128 and CVE-2026-20133 — in February. Cisco Warns of Ongoing Exploitation of SD-WAN Zero-Day CVE-2026-20182
Box (ORB) networks, with the cybersecurity company also observing multiple threat clusters exploiting CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 beginning March 2026. CISA Adds Cisco SD-WAN Authentication Bypass to KEV After Active Exploitation
CISA flags another Cisco Catalyst SD-WAN Manager bug as exploited (CVE-2026-20133) Week in Review: Claude Mythos Finds 271 Firefox Vulnerabilities; Vercel Reports Breach
CISA has ordered federal agencies to secure Catalyst SD-WAN Manager systems within four days after adding an information-disclosure flaw (CVE-2026-20133) to its Known Exploited Vulnerabilities catalog. CISA Flags Cisco SD-WAN Flaw as Actively Exploited, Orders Agencies to Patch

CVE (18)

Malware (11)

People (5)

Threat Actors (11)

MITRE ATT&CK (20)

Vendors (17)

Products (27)

Tools (11)

Industries (5)

Countries (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.