Vulnerability-Lookup

CVE-2026-20122 (GCVE-0-2026-20122)

Vulnerability from cvelistv5 – Published: 2026-02-25 16:14 – Updated: 2026-02-25 18:14

Title

Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability

Summary

A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

Severity ?

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-648 - Incorrect Use of Privileged APIs

Assigner

cisco

References

URL

Tags

https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Catalyst SD-WAN Manager	Affected: 20.1.12 Affected: 19.2.1 Affected: 18.4.4 Affected: 18.4.5 Affected: 20.1.1.1 Affected: 20.1.1 Affected: 19.3.0 Affected: 19.2.2 Affected: 19.2.099 Affected: 18.3.6 Affected: 18.3.7 Affected: 19.2.0 Affected: 18.3.8 Affected: 19.0.0 Affected: 19.1.0 Affected: 18.4.302 Affected: 18.4.303 Affected: 19.2.097 Affected: 19.2.098 Affected: 17.2.10 Affected: 18.3.6.1 Affected: 19.0.1a Affected: 18.2.0 Affected: 18.4.3 Affected: 18.4.1 Affected: 17.2.8 Affected: 18.3.3.1 Affected: 18.4.0 Affected: 18.3.1 Affected: 17.2.6 Affected: 17.2.9 Affected: 18.3.4 Affected: 17.2.5 Affected: 18.3.1.1 Affected: 18.3.5 Affected: 18.4.0.1 Affected: 18.3.3 Affected: 17.2.7 Affected: 17.2.4 Affected: 18.3.0 Affected: 19.2.3 Affected: 18.4.501_ES Affected: 20.3.1 Affected: 20.1.2 Affected: 19.2.929 Affected: 19.2.31 Affected: 20.3.2 Affected: 19.2.32 Affected: 20.3.2_925 Affected: 20.3.2.1 Affected: 20.3.2.1_927 Affected: 18.4.6 Affected: 20.1.2_937 Affected: 20.4.1 Affected: 20.3.2_928 Affected: 20.3.2_929 Affected: 20.4.1.0.1 Affected: 20.3.2.1_930 Affected: 19.2.4 Affected: 20.5.0.1.1 Affected: 20.4.1.1 Affected: 20.3.3 Affected: 19.2.4.0.1 Affected: 20.3.2_937 Affected: 20.3.3.1 Affected: 20.5.1 Affected: 20.1.3 Affected: 20.3.3.0.4 Affected: 20.3.3.1.2 Affected: 20.3.3.1.1 Affected: 20.4.1.2 Affected: 20.3.3.0.2 Affected: 20.4.1.1.5 Affected: 20.4.1.0.01 Affected: 20.4.1.0.02 Affected: 20.3.3.1.7 Affected: 20.3.3.1.5 Affected: 20.5.1.0.1 Affected: 20.3.3.1.10 Affected: 20.3.3.0.8 Affected: 20.4.2 Affected: 20.4.2.0.1 Affected: 20.3.4 Affected: 20.3.3.0.14 Affected: 19.2.4.0.8 Affected: 19.2.4.0.9 Affected: 20.3.4.0.1 Affected: 20.3.2.0.5 Affected: 20.6.1 Affected: 20.5.1.0.2 Affected: 20.3.3.0.17 Affected: 20.6.1.1 Affected: 20.6.0.18.3 Affected: 20.3.2.0.6 Affected: 20.6.0.18.4 Affected: 20.4.2.0.2 Affected: 20.3.3.0.16 Affected: 20.3.4.0.5 Affected: 20.6.1.0.1 Affected: 20.3.4.0.6 Affected: 20.6.2 Affected: 20.7.1EFT2 Affected: 20.3.4.0.9 Affected: 20.3.4.0.11 Affected: 20.4.2.0.4 Affected: 20.3.3.0.18 Affected: 20.7.1 Affected: 20.6.2.1 Affected: 20.3.4.1 Affected: 20.5.1.1 Affected: 20.4.2.1 Affected: 20.4.2.1.1 Affected: 20.3.4.1.1 Affected: 20.3.813 Affected: 20.3.4.0.19 Affected: 20.4.2.2.1 Affected: 20.5.1.2 Affected: 20.3.4.2 Affected: 20.3.814 Affected: 20.4.2.2 Affected: 20.6.2.2 Affected: 20.3.4.2.1 Affected: 20.7.1.1 Affected: 20.3.4.1.2 Affected: 20.6.2.2.2 Affected: 20.3.4.0.20 Affected: 20.6.2.2.3 Affected: 20.4.2.2.2 Affected: 20.3.5 Affected: 20.6.2.0.4 Affected: 20.4.2.2.3 Affected: 20.3.4.0.24 Affected: 20.6.2.2.7 Affected: 20.6.3 Affected: 20.3.4.2.2 Affected: 20.4.2.2.4 Affected: 20.7.1.0.2 Affected: 20.8.1 Affected: 20.3.5.0.8 Affected: 20.3.5.0.9 Affected: 20.4.2.2.8 Affected: 20.3.5.0.7 Affected: 20.6.3.0.7 Affected: 20.6.3.0.5 Affected: 20.6.3.0.10 Affected: 20.6.3.0.2 Affected: 20.7.2 Affected: 20.9.1EFT2 Affected: 20.6.3.0.11 Affected: 20.6.3.1 Affected: 20.6.3.0.14 Affected: 20.6.4 Affected: 20.9.1 Affected: 20.6.3.0.19 Affected: 20.6.3.0.18 Affected: 20.3.6 Affected: 20.9.1.1 Affected: 20.6.3.0.23 Affected: 20.6.4.0.4 Affected: 20.6.3.0.25 Affected: 20.6.5 Affected: 20.6.3.0.27 Affected: 20.9.2 Affected: 20.9.2.1 Affected: 20.6.3.0.29 Affected: 20.6.3.0.31 Affected: 20.6.3.0.32 Affected: 20.10.1 Affected: 20.6.3.0.33 Affected: 20.9.2.0.01 Affected: 20.9.1_LI_Images Affected: 20.10.1_LI_Images Affected: 20.9.2_LI_Images Affected: 20.3.7 Affected: 20.9.3 Affected: 20.6.5.1 Affected: 20.11.1 Affected: 20.11.1_LI_Images Affected: 20.9.3_LI_ Images Affected: 20.6.3.1.1 Affected: 20.9.3.0.2 Affected: 20.6.5.1.2 Affected: 20.9.3.0.3 Affected: 20.4.2.3 Affected: 20.6.3.2 Affected: 20.6.4.1 Affected: 20.6.3.0.38 Affected: 20.6.3.0.39 Affected: 20.3.5.1 Affected: 20.3.4.3 Affected: 20.9.3.1 Affected: 20.3.3.2 Affected: 20.6.5.2 Affected: 20.3.7.1 Affected: 20.10.1.1 Affected: 20.6.5.2.1 Affected: 20.3.4.0.25 Affected: 20.6.2.2.4 Affected: 20.6.1.2 Affected: 20.11.1.1 Affected: 20.9.3.0.5 Affected: 20.3.4.0.26 Affected: 20.6.5.1.3 Affected: 20.6.3.0.40 Affected: 20.1.3.1 Affected: 20.9.2.2 Affected: 20.6.5.2.3 Affected: 20.6.5.1.4 Affected: 20.6.5.3 Affected: 20.6.3.0.41 Affected: 20.9.3.0.7 Affected: 20.6.5.1.5 Affected: 20.9.3.0.4 Affected: 20.6.4.0.19 Affected: 20.6.5.1.6 Affected: 20.9.3.0.8 Affected: 20.6.3.3 Affected: 20.3.7.2 Affected: 20.6.5.4 Affected: 20.6.5.1.7 Affected: 20.9.3.0.12 Affected: 20.6.4.2 Affected: 20.6.5.5 Affected: 20.9.3.2 Affected: 20.11.1.2 Affected: 20.6.3.4 Affected: 20.10.1.2 Affected: 20.6.5.1.9 Affected: 20.9.3.0.16 Affected: 20.6.3.0.45 Affected: 20.6.5.1.10 Affected: 20.9.3.0.17 Affected: 20.6.5.2.4 Affected: 20.6.4.0.21 Affected: 20.9.3.0.18 Affected: 20.6.3.0.46 Affected: 20.6.3.0.47 Affected: 20.9.2.3 Affected: 20.9.3.2_LI_Images Affected: 20.9.3.0.21 Affected: 20.9.3.0.20 Affected: 20.9.4_LI_Images Affected: 20.9.4 Affected: 20.6.5.1.11 Affected: 20.12.1 Affected: 20.12.1_LI_Images Affected: 20.6.5.1.13 Affected: 20.9.3.0.23 Affected: 20.6.5.2.8 Affected: 20.9.4.1 Affected: 20.9.4.1_LI_Images Affected: 20.9.3.0.25 Affected: 20.9.3.0.24 Affected: 20.6.5.1.14 Affected: 20.3.8 Affected: 20.6.6 Affected: 20.9.3.0.26 Affected: 20.6.3.0.51 Affected: 20.9.3.0.29 Affected: 20.12.2 Affected: 20.12.2_LI_Images Affected: 20.6.6.0.1 Affected: 20.13.1_LI_Images Affected: 20.9.4.0.4 Affected: 20.13.1 Affected: 20.9.4.1.1 Affected: 20.9.5 Affected: 20.9.5_LI_Images Affected: 20.12.3_LI_Images Affected: 20.12.3 Affected: 20.9.4.1.3 Affected: 20.6.7 Affected: 20.9.5.1 Affected: 20.9.5.1_LI_Images Affected: 20.9.4.1.6 Affected: 20.14.1 Affected: 20.14.1_LI_Images Affected: 20.9.5.2 Affected: 20.9.5.2.1 Affected: 20.9.5.2_LI_Images Affected: 20.12.3.1 Affected: 20.12.4 Affected: 20.15.1_LI_Images Affected: 20.15.1 Affected: 20.9.5.1.4 Affected: 20.9.5.2.7 Affected: 20.9.5.2.13 Affected: 20.9.6 Affected: 20.9.6_LI_Images Affected: 20.9.5.2.14 Affected: 20.6.8 Affected: 20.12.4.0.03 Affected: 20.16.1 Affected: 20.16.1_LI_Images Affected: 20.12.4_LI_Images Affected: 20.9.5.2.16 Affected: 20.12.4.0.4 Affected: 20.12.401 Affected: 20.9.5.3 Affected: 20.9.5.3_LI_Images Affected: 20.12.4.1_LI_Images Affected: 20.12.4.1 Affected: 20.9.5.2.21 Affected: 20.9.6.0.3 Affected: 20.12.4.0.6 Affected: 20.15.2_LI_Images Affected: 20.15.2 Affected: 20.12.4_Monthly_ES5 Affected: 20.12.5 Affected: 20.12.5_LI_Images Affected: 20.9.7_LI _Images Affected: 20.9.7 Affected: 20.15.3 Affected: 20.15.3_ LI _Images Affected: 20.12.501 Affected: 20.12.5.1_LI_Images Affected: 20.12.5.1 Affected: 20.12.5.2_LI_Images Affected: 20.12.5.2 Affected: 20.15.3.1 Affected: 20.15.4_LI_Images Affected: 20.15.4 Affected: 20.9.7.1_LI _Images Affected: 20.9.7.1 Affected: 20.18.1 Affected: 20.18.1_LI_Images Affected: 20.12.6_LI_Images Affected: 20.12.6 Affected: 20.12.5.1.01 Affected: 20.9.8 Affected: 20.9.8_LI_Images Affected: 20.18.2 Affected: 20.15.4.1_LI_Images Affected: 20.15.4.1 Affected: 20.18.2_LI_Images

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20122",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-25T18:14:14.824059Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-25T18:14:27.915Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Catalyst SD-WAN Manager",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "20.1.12"
            },
            {
              "status": "affected",
              "version": "19.2.1"
            },
            {
              "status": "affected",
              "version": "18.4.4"
            },
            {
              "status": "affected",
              "version": "18.4.5"
            },
            {
              "status": "affected",
              "version": "20.1.1.1"
            },
            {
              "status": "affected",
              "version": "20.1.1"
            },
            {
              "status": "affected",
              "version": "19.3.0"
            },
            {
              "status": "affected",
              "version": "19.2.2"
            },
            {
              "status": "affected",
              "version": "19.2.099"
            },
            {
              "status": "affected",
              "version": "18.3.6"
            },
            {
              "status": "affected",
              "version": "18.3.7"
            },
            {
              "status": "affected",
              "version": "19.2.0"
            },
            {
              "status": "affected",
              "version": "18.3.8"
            },
            {
              "status": "affected",
              "version": "19.0.0"
            },
            {
              "status": "affected",
              "version": "19.1.0"
            },
            {
              "status": "affected",
              "version": "18.4.302"
            },
            {
              "status": "affected",
              "version": "18.4.303"
            },
            {
              "status": "affected",
              "version": "19.2.097"
            },
            {
              "status": "affected",
              "version": "19.2.098"
            },
            {
              "status": "affected",
              "version": "17.2.10"
            },
            {
              "status": "affected",
              "version": "18.3.6.1"
            },
            {
              "status": "affected",
              "version": "19.0.1a"
            },
            {
              "status": "affected",
              "version": "18.2.0"
            },
            {
              "status": "affected",
              "version": "18.4.3"
            },
            {
              "status": "affected",
              "version": "18.4.1"
            },
            {
              "status": "affected",
              "version": "17.2.8"
            },
            {
              "status": "affected",
              "version": "18.3.3.1"
            },
            {
              "status": "affected",
              "version": "18.4.0"
            },
            {
              "status": "affected",
              "version": "18.3.1"
            },
            {
              "status": "affected",
              "version": "17.2.6"
            },
            {
              "status": "affected",
              "version": "17.2.9"
            },
            {
              "status": "affected",
              "version": "18.3.4"
            },
            {
              "status": "affected",
              "version": "17.2.5"
            },
            {
              "status": "affected",
              "version": "18.3.1.1"
            },
            {
              "status": "affected",
              "version": "18.3.5"
            },
            {
              "status": "affected",
              "version": "18.4.0.1"
            },
            {
              "status": "affected",
              "version": "18.3.3"
            },
            {
              "status": "affected",
              "version": "17.2.7"
            },
            {
              "status": "affected",
              "version": "17.2.4"
            },
            {
              "status": "affected",
              "version": "18.3.0"
            },
            {
              "status": "affected",
              "version": "19.2.3"
            },
            {
              "status": "affected",
              "version": "18.4.501_ES"
            },
            {
              "status": "affected",
              "version": "20.3.1"
            },
            {
              "status": "affected",
              "version": "20.1.2"
            },
            {
              "status": "affected",
              "version": "19.2.929"
            },
            {
              "status": "affected",
              "version": "19.2.31"
            },
            {
              "status": "affected",
              "version": "20.3.2"
            },
            {
              "status": "affected",
              "version": "19.2.32"
            },
            {
              "status": "affected",
              "version": "20.3.2_925"
            },
            {
              "status": "affected",
              "version": "20.3.2.1"
            },
            {
              "status": "affected",
              "version": "20.3.2.1_927"
            },
            {
              "status": "affected",
              "version": "18.4.6"
            },
            {
              "status": "affected",
              "version": "20.1.2_937"
            },
            {
              "status": "affected",
              "version": "20.4.1"
            },
            {
              "status": "affected",
              "version": "20.3.2_928"
            },
            {
              "status": "affected",
              "version": "20.3.2_929"
            },
            {
              "status": "affected",
              "version": "20.4.1.0.1"
            },
            {
              "status": "affected",
              "version": "20.3.2.1_930"
            },
            {
              "status": "affected",
              "version": "19.2.4"
            },
            {
              "status": "affected",
              "version": "20.5.0.1.1"
            },
            {
              "status": "affected",
              "version": "20.4.1.1"
            },
            {
              "status": "affected",
              "version": "20.3.3"
            },
            {
              "status": "affected",
              "version": "19.2.4.0.1"
            },
            {
              "status": "affected",
              "version": "20.3.2_937"
            },
            {
              "status": "affected",
              "version": "20.3.3.1"
            },
            {
              "status": "affected",
              "version": "20.5.1"
            },
            {
              "status": "affected",
              "version": "20.1.3"
            },
            {
              "status": "affected",
              "version": "20.3.3.0.4"
            },
            {
              "status": "affected",
              "version": "20.3.3.1.2"
            },
            {
              "status": "affected",
              "version": "20.3.3.1.1"
            },
            {
              "status": "affected",
              "version": "20.4.1.2"
            },
            {
              "status": "affected",
              "version": "20.3.3.0.2"
            },
            {
              "status": "affected",
              "version": "20.4.1.1.5"
            },
            {
              "status": "affected",
              "version": "20.4.1.0.01"
            },
            {
              "status": "affected",
              "version": "20.4.1.0.02"
            },
            {
              "status": "affected",
              "version": "20.3.3.1.7"
            },
            {
              "status": "affected",
              "version": "20.3.3.1.5"
            },
            {
              "status": "affected",
              "version": "20.5.1.0.1"
            },
            {
              "status": "affected",
              "version": "20.3.3.1.10"
            },
            {
              "status": "affected",
              "version": "20.3.3.0.8"
            },
            {
              "status": "affected",
              "version": "20.4.2"
            },
            {
              "status": "affected",
              "version": "20.4.2.0.1"
            },
            {
              "status": "affected",
              "version": "20.3.4"
            },
            {
              "status": "affected",
              "version": "20.3.3.0.14"
            },
            {
              "status": "affected",
              "version": "19.2.4.0.8"
            },
            {
              "status": "affected",
              "version": "19.2.4.0.9"
            },
            {
              "status": "affected",
              "version": "20.3.4.0.1"
            },
            {
              "status": "affected",
              "version": "20.3.2.0.5"
            },
            {
              "status": "affected",
              "version": "20.6.1"
            },
            {
              "status": "affected",
              "version": "20.5.1.0.2"
            },
            {
              "status": "affected",
              "version": "20.3.3.0.17"
            },
            {
              "status": "affected",
              "version": "20.6.1.1"
            },
            {
              "status": "affected",
              "version": "20.6.0.18.3"
            },
            {
              "status": "affected",
              "version": "20.3.2.0.6"
            },
            {
              "status": "affected",
              "version": "20.6.0.18.4"
            },
            {
              "status": "affected",
              "version": "20.4.2.0.2"
            },
            {
              "status": "affected",
              "version": "20.3.3.0.16"
            },
            {
              "status": "affected",
              "version": "20.3.4.0.5"
            },
            {
              "status": "affected",
              "version": "20.6.1.0.1"
            },
            {
              "status": "affected",
              "version": "20.3.4.0.6"
            },
            {
              "status": "affected",
              "version": "20.6.2"
            },
            {
              "status": "affected",
              "version": "20.7.1EFT2"
            },
            {
              "status": "affected",
              "version": "20.3.4.0.9"
            },
            {
              "status": "affected",
              "version": "20.3.4.0.11"
            },
            {
              "status": "affected",
              "version": "20.4.2.0.4"
            },
            {
              "status": "affected",
              "version": "20.3.3.0.18"
            },
            {
              "status": "affected",
              "version": "20.7.1"
            },
            {
              "status": "affected",
              "version": "20.6.2.1"
            },
            {
              "status": "affected",
              "version": "20.3.4.1"
            },
            {
              "status": "affected",
              "version": "20.5.1.1"
            },
            {
              "status": "affected",
              "version": "20.4.2.1"
            },
            {
              "status": "affected",
              "version": "20.4.2.1.1"
            },
            {
              "status": "affected",
              "version": "20.3.4.1.1"
            },
            {
              "status": "affected",
              "version": "20.3.813"
            },
            {
              "status": "affected",
              "version": "20.3.4.0.19"
            },
            {
              "status": "affected",
              "version": "20.4.2.2.1"
            },
            {
              "status": "affected",
              "version": "20.5.1.2"
            },
            {
              "status": "affected",
              "version": "20.3.4.2"
            },
            {
              "status": "affected",
              "version": "20.3.814"
            },
            {
              "status": "affected",
              "version": "20.4.2.2"
            },
            {
              "status": "affected",
              "version": "20.6.2.2"
            },
            {
              "status": "affected",
              "version": "20.3.4.2.1"
            },
            {
              "status": "affected",
              "version": "20.7.1.1"
            },
            {
              "status": "affected",
              "version": "20.3.4.1.2"
            },
            {
              "status": "affected",
              "version": "20.6.2.2.2"
            },
            {
              "status": "affected",
              "version": "20.3.4.0.20"
            },
            {
              "status": "affected",
              "version": "20.6.2.2.3"
            },
            {
              "status": "affected",
              "version": "20.4.2.2.2"
            },
            {
              "status": "affected",
              "version": "20.3.5"
            },
            {
              "status": "affected",
              "version": "20.6.2.0.4"
            },
            {
              "status": "affected",
              "version": "20.4.2.2.3"
            },
            {
              "status": "affected",
              "version": "20.3.4.0.24"
            },
            {
              "status": "affected",
              "version": "20.6.2.2.7"
            },
            {
              "status": "affected",
              "version": "20.6.3"
            },
            {
              "status": "affected",
              "version": "20.3.4.2.2"
            },
            {
              "status": "affected",
              "version": "20.4.2.2.4"
            },
            {
              "status": "affected",
              "version": "20.7.1.0.2"
            },
            {
              "status": "affected",
              "version": "20.8.1"
            },
            {
              "status": "affected",
              "version": "20.3.5.0.8"
            },
            {
              "status": "affected",
              "version": "20.3.5.0.9"
            },
            {
              "status": "affected",
              "version": "20.4.2.2.8"
            },
            {
              "status": "affected",
              "version": "20.3.5.0.7"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.7"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.5"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.10"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.2"
            },
            {
              "status": "affected",
              "version": "20.7.2"
            },
            {
              "status": "affected",
              "version": "20.9.1EFT2"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.11"
            },
            {
              "status": "affected",
              "version": "20.6.3.1"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.14"
            },
            {
              "status": "affected",
              "version": "20.6.4"
            },
            {
              "status": "affected",
              "version": "20.9.1"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.19"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.18"
            },
            {
              "status": "affected",
              "version": "20.3.6"
            },
            {
              "status": "affected",
              "version": "20.9.1.1"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.23"
            },
            {
              "status": "affected",
              "version": "20.6.4.0.4"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.25"
            },
            {
              "status": "affected",
              "version": "20.6.5"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.27"
            },
            {
              "status": "affected",
              "version": "20.9.2"
            },
            {
              "status": "affected",
              "version": "20.9.2.1"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.29"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.31"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.32"
            },
            {
              "status": "affected",
              "version": "20.10.1"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.33"
            },
            {
              "status": "affected",
              "version": "20.9.2.0.01"
            },
            {
              "status": "affected",
              "version": "20.9.1_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.10.1_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.9.2_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.3.7"
            },
            {
              "status": "affected",
              "version": "20.9.3"
            },
            {
              "status": "affected",
              "version": "20.6.5.1"
            },
            {
              "status": "affected",
              "version": "20.11.1"
            },
            {
              "status": "affected",
              "version": "20.11.1_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.9.3_LI_ Images"
            },
            {
              "status": "affected",
              "version": "20.6.3.1.1"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.2"
            },
            {
              "status": "affected",
              "version": "20.6.5.1.2"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.3"
            },
            {
              "status": "affected",
              "version": "20.4.2.3"
            },
            {
              "status": "affected",
              "version": "20.6.3.2"
            },
            {
              "status": "affected",
              "version": "20.6.4.1"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.38"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.39"
            },
            {
              "status": "affected",
              "version": "20.3.5.1"
            },
            {
              "status": "affected",
              "version": "20.3.4.3"
            },
            {
              "status": "affected",
              "version": "20.9.3.1"
            },
            {
              "status": "affected",
              "version": "20.3.3.2"
            },
            {
              "status": "affected",
              "version": "20.6.5.2"
            },
            {
              "status": "affected",
              "version": "20.3.7.1"
            },
            {
              "status": "affected",
              "version": "20.10.1.1"
            },
            {
              "status": "affected",
              "version": "20.6.5.2.1"
            },
            {
              "status": "affected",
              "version": "20.3.4.0.25"
            },
            {
              "status": "affected",
              "version": "20.6.2.2.4"
            },
            {
              "status": "affected",
              "version": "20.6.1.2"
            },
            {
              "status": "affected",
              "version": "20.11.1.1"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.5"
            },
            {
              "status": "affected",
              "version": "20.3.4.0.26"
            },
            {
              "status": "affected",
              "version": "20.6.5.1.3"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.40"
            },
            {
              "status": "affected",
              "version": "20.1.3.1"
            },
            {
              "status": "affected",
              "version": "20.9.2.2"
            },
            {
              "status": "affected",
              "version": "20.6.5.2.3"
            },
            {
              "status": "affected",
              "version": "20.6.5.1.4"
            },
            {
              "status": "affected",
              "version": "20.6.5.3"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.41"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.7"
            },
            {
              "status": "affected",
              "version": "20.6.5.1.5"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.4"
            },
            {
              "status": "affected",
              "version": "20.6.4.0.19"
            },
            {
              "status": "affected",
              "version": "20.6.5.1.6"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.8"
            },
            {
              "status": "affected",
              "version": "20.6.3.3"
            },
            {
              "status": "affected",
              "version": "20.3.7.2"
            },
            {
              "status": "affected",
              "version": "20.6.5.4"
            },
            {
              "status": "affected",
              "version": "20.6.5.1.7"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.12"
            },
            {
              "status": "affected",
              "version": "20.6.4.2"
            },
            {
              "status": "affected",
              "version": "20.6.5.5"
            },
            {
              "status": "affected",
              "version": "20.9.3.2"
            },
            {
              "status": "affected",
              "version": "20.11.1.2"
            },
            {
              "status": "affected",
              "version": "20.6.3.4"
            },
            {
              "status": "affected",
              "version": "20.10.1.2"
            },
            {
              "status": "affected",
              "version": "20.6.5.1.9"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.16"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.45"
            },
            {
              "status": "affected",
              "version": "20.6.5.1.10"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.17"
            },
            {
              "status": "affected",
              "version": "20.6.5.2.4"
            },
            {
              "status": "affected",
              "version": "20.6.4.0.21"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.18"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.46"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.47"
            },
            {
              "status": "affected",
              "version": "20.9.2.3"
            },
            {
              "status": "affected",
              "version": "20.9.3.2_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.21"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.20"
            },
            {
              "status": "affected",
              "version": "20.9.4_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.9.4"
            },
            {
              "status": "affected",
              "version": "20.6.5.1.11"
            },
            {
              "status": "affected",
              "version": "20.12.1"
            },
            {
              "status": "affected",
              "version": "20.12.1_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.6.5.1.13"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.23"
            },
            {
              "status": "affected",
              "version": "20.6.5.2.8"
            },
            {
              "status": "affected",
              "version": "20.9.4.1"
            },
            {
              "status": "affected",
              "version": "20.9.4.1_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.25"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.24"
            },
            {
              "status": "affected",
              "version": "20.6.5.1.14"
            },
            {
              "status": "affected",
              "version": "20.3.8"
            },
            {
              "status": "affected",
              "version": "20.6.6"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.26"
            },
            {
              "status": "affected",
              "version": "20.6.3.0.51"
            },
            {
              "status": "affected",
              "version": "20.9.3.0.29"
            },
            {
              "status": "affected",
              "version": "20.12.2"
            },
            {
              "status": "affected",
              "version": "20.12.2_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.6.6.0.1"
            },
            {
              "status": "affected",
              "version": "20.13.1_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.9.4.0.4"
            },
            {
              "status": "affected",
              "version": "20.13.1"
            },
            {
              "status": "affected",
              "version": "20.9.4.1.1"
            },
            {
              "status": "affected",
              "version": "20.9.5"
            },
            {
              "status": "affected",
              "version": "20.9.5_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.12.3_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.12.3"
            },
            {
              "status": "affected",
              "version": "20.9.4.1.3"
            },
            {
              "status": "affected",
              "version": "20.6.7"
            },
            {
              "status": "affected",
              "version": "20.9.5.1"
            },
            {
              "status": "affected",
              "version": "20.9.5.1_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.9.4.1.6"
            },
            {
              "status": "affected",
              "version": "20.14.1"
            },
            {
              "status": "affected",
              "version": "20.14.1_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.9.5.2"
            },
            {
              "status": "affected",
              "version": "20.9.5.2.1"
            },
            {
              "status": "affected",
              "version": "20.9.5.2_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.12.3.1"
            },
            {
              "status": "affected",
              "version": "20.12.4"
            },
            {
              "status": "affected",
              "version": "20.15.1_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.15.1"
            },
            {
              "status": "affected",
              "version": "20.9.5.1.4"
            },
            {
              "status": "affected",
              "version": "20.9.5.2.7"
            },
            {
              "status": "affected",
              "version": "20.9.5.2.13"
            },
            {
              "status": "affected",
              "version": "20.9.6"
            },
            {
              "status": "affected",
              "version": "20.9.6_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.9.5.2.14"
            },
            {
              "status": "affected",
              "version": "20.6.8"
            },
            {
              "status": "affected",
              "version": "20.12.4.0.03"
            },
            {
              "status": "affected",
              "version": "20.16.1"
            },
            {
              "status": "affected",
              "version": "20.16.1_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.12.4_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.9.5.2.16"
            },
            {
              "status": "affected",
              "version": "20.12.4.0.4"
            },
            {
              "status": "affected",
              "version": "20.12.401"
            },
            {
              "status": "affected",
              "version": "20.9.5.3"
            },
            {
              "status": "affected",
              "version": "20.9.5.3_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.12.4.1_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.12.4.1"
            },
            {
              "status": "affected",
              "version": "20.9.5.2.21"
            },
            {
              "status": "affected",
              "version": "20.9.6.0.3"
            },
            {
              "status": "affected",
              "version": "20.12.4.0.6"
            },
            {
              "status": "affected",
              "version": "20.15.2_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.15.2"
            },
            {
              "status": "affected",
              "version": "20.12.4_Monthly_ES5"
            },
            {
              "status": "affected",
              "version": "20.12.5"
            },
            {
              "status": "affected",
              "version": "20.12.5_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.9.7_LI _Images"
            },
            {
              "status": "affected",
              "version": "20.9.7"
            },
            {
              "status": "affected",
              "version": "20.15.3"
            },
            {
              "status": "affected",
              "version": "20.15.3_ LI _Images"
            },
            {
              "status": "affected",
              "version": "20.12.501"
            },
            {
              "status": "affected",
              "version": "20.12.5.1_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.12.5.1"
            },
            {
              "status": "affected",
              "version": "20.12.5.2_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.12.5.2"
            },
            {
              "status": "affected",
              "version": "20.15.3.1"
            },
            {
              "status": "affected",
              "version": "20.15.4_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.15.4"
            },
            {
              "status": "affected",
              "version": "20.9.7.1_LI _Images"
            },
            {
              "status": "affected",
              "version": "20.9.7.1"
            },
            {
              "status": "affected",
              "version": "20.18.1"
            },
            {
              "status": "affected",
              "version": "20.18.1_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.12.6_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.12.6"
            },
            {
              "status": "affected",
              "version": "20.12.5.1.01"
            },
            {
              "status": "affected",
              "version": "20.9.8"
            },
            {
              "status": "affected",
              "version": "20.9.8_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.18.2"
            },
            {
              "status": "affected",
              "version": "20.15.4.1_LI_Images"
            },
            {
              "status": "affected",
              "version": "20.15.4.1"
            },
            {
              "status": "affected",
              "version": "20.18.2_LI_Images"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system.\r\n\r\nThis vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system\u0026nbsp;and gain vmanage user privileges."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-648",
              "description": "Incorrect Use of Privileged APIs",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-25T16:17:57.583Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-sdwan-authbp-qwCX8D4v",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"
        }
      ],
      "source": {
        "advisory": "cisco-sa-sdwan-authbp-qwCX8D4v",
        "defects": [
          "CSCws33584"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-20122",
    "datePublished": "2026-02-25T16:14:21.256Z",
    "dateReserved": "2025-10-08T11:59:15.377Z",
    "dateUpdated": "2026-02-25T18:14:27.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-20122\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2026-02-25T17:25:28.170\",\"lastModified\":\"2026-02-25T17:25:28.170\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system.\\r\\n\\r\\nThis vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system\u0026nbsp;and gain vmanage user privileges.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-648\"}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v\",\"source\":\"psirt@cisco.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-20122\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-25T18:14:14.824059Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-25T18:14:22.592Z\"}}], \"cna\": {\"title\": \"Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability\", \"source\": {\"defects\": [\"CSCws33584\"], \"advisory\": \"cisco-sa-sdwan-authbp-qwCX8D4v\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco Catalyst SD-WAN Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"20.1.12\"}, {\"status\": \"affected\", \"version\": \"19.2.1\"}, {\"status\": \"affected\", \"version\": \"18.4.4\"}, {\"status\": \"affected\", \"version\": \"18.4.5\"}, {\"status\": \"affected\", \"version\": \"20.1.1.1\"}, {\"status\": \"affected\", \"version\": \"20.1.1\"}, {\"status\": \"affected\", \"version\": \"19.3.0\"}, {\"status\": \"affected\", \"version\": \"19.2.2\"}, {\"status\": \"affected\", \"version\": \"19.2.099\"}, {\"status\": \"affected\", \"version\": \"18.3.6\"}, {\"status\": \"affected\", \"version\": \"18.3.7\"}, {\"status\": \"affected\", \"version\": \"19.2.0\"}, {\"status\": \"affected\", \"version\": \"18.3.8\"}, {\"status\": \"affected\", \"version\": \"19.0.0\"}, {\"status\": \"affected\", \"version\": \"19.1.0\"}, {\"status\": \"affected\", \"version\": \"18.4.302\"}, {\"status\": \"affected\", \"version\": \"18.4.303\"}, {\"status\": \"affected\", \"version\": \"19.2.097\"}, {\"status\": \"affected\", \"version\": \"19.2.098\"}, {\"status\": \"affected\", \"version\": \"17.2.10\"}, {\"status\": \"affected\", \"version\": \"18.3.6.1\"}, {\"status\": \"affected\", \"version\": \"19.0.1a\"}, {\"status\": \"affected\", \"version\": \"18.2.0\"}, {\"status\": \"affected\", \"version\": \"18.4.3\"}, {\"status\": \"affected\", \"version\": \"18.4.1\"}, {\"status\": \"affected\", \"version\": \"17.2.8\"}, {\"status\": \"affected\", \"version\": \"18.3.3.1\"}, {\"status\": \"affected\", \"version\": \"18.4.0\"}, {\"status\": \"affected\", \"version\": \"18.3.1\"}, {\"status\": \"affected\", \"version\": \"17.2.6\"}, {\"status\": \"affected\", \"version\": \"17.2.9\"}, {\"status\": \"affected\", \"version\": \"18.3.4\"}, {\"status\": \"affected\", \"version\": \"17.2.5\"}, {\"status\": \"affected\", \"version\": \"18.3.1.1\"}, {\"status\": \"affected\", \"version\": \"18.3.5\"}, {\"status\": \"affected\", \"version\": \"18.4.0.1\"}, {\"status\": \"affected\", \"version\": \"18.3.3\"}, {\"status\": \"affected\", \"version\": \"17.2.7\"}, {\"status\": \"affected\", \"version\": \"17.2.4\"}, {\"status\": \"affected\", \"version\": \"18.3.0\"}, {\"status\": \"affected\", \"version\": \"19.2.3\"}, {\"status\": \"affected\", \"version\": \"18.4.501_ES\"}, {\"status\": \"affected\", \"version\": \"20.3.1\"}, {\"status\": \"affected\", \"version\": \"20.1.2\"}, {\"status\": \"affected\", \"version\": \"19.2.929\"}, {\"status\": \"affected\", \"version\": \"19.2.31\"}, {\"status\": \"affected\", \"version\": \"20.3.2\"}, {\"status\": \"affected\", \"version\": \"19.2.32\"}, {\"status\": \"affected\", \"version\": \"20.3.2_925\"}, {\"status\": \"affected\", \"version\": \"20.3.2.1\"}, {\"status\": \"affected\", \"version\": \"20.3.2.1_927\"}, {\"status\": \"affected\", \"version\": \"18.4.6\"}, {\"status\": \"affected\", \"version\": \"20.1.2_937\"}, {\"status\": \"affected\", \"version\": \"20.4.1\"}, {\"status\": \"affected\", \"version\": \"20.3.2_928\"}, {\"status\": \"affected\", \"version\": \"20.3.2_929\"}, {\"status\": \"affected\", \"version\": \"20.4.1.0.1\"}, {\"status\": \"affected\", \"version\": \"20.3.2.1_930\"}, {\"status\": \"affected\", \"version\": \"19.2.4\"}, {\"status\": \"affected\", \"version\": \"20.5.0.1.1\"}, {\"status\": \"affected\", \"version\": \"20.4.1.1\"}, {\"status\": \"affected\", \"version\": \"20.3.3\"}, {\"status\": \"affected\", \"version\": \"19.2.4.0.1\"}, {\"status\": \"affected\", \"version\": \"20.3.2_937\"}, {\"status\": \"affected\", \"version\": \"20.3.3.1\"}, {\"status\": \"affected\", \"version\": \"20.5.1\"}, {\"status\": \"affected\", \"version\": \"20.1.3\"}, {\"status\": \"affected\", \"version\": \"20.3.3.0.4\"}, {\"status\": \"affected\", \"version\": \"20.3.3.1.2\"}, {\"status\": \"affected\", \"version\": \"20.3.3.1.1\"}, {\"status\": \"affected\", \"version\": \"20.4.1.2\"}, {\"status\": \"affected\", \"version\": \"20.3.3.0.2\"}, {\"status\": \"affected\", \"version\": \"20.4.1.1.5\"}, {\"status\": \"affected\", \"version\": \"20.4.1.0.01\"}, {\"status\": \"affected\", \"version\": \"20.4.1.0.02\"}, {\"status\": \"affected\", \"version\": \"20.3.3.1.7\"}, {\"status\": \"affected\", \"version\": \"20.3.3.1.5\"}, {\"status\": \"affected\", \"version\": \"20.5.1.0.1\"}, {\"status\": \"affected\", \"version\": \"20.3.3.1.10\"}, {\"status\": \"affected\", \"version\": \"20.3.3.0.8\"}, {\"status\": \"affected\", \"version\": \"20.4.2\"}, {\"status\": \"affected\", \"version\": \"20.4.2.0.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4\"}, {\"status\": \"affected\", \"version\": \"20.3.3.0.14\"}, {\"status\": \"affected\", \"version\": \"19.2.4.0.8\"}, {\"status\": \"affected\", \"version\": \"19.2.4.0.9\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.1\"}, {\"status\": \"affected\", \"version\": \"20.3.2.0.5\"}, {\"status\": \"affected\", \"version\": \"20.6.1\"}, {\"status\": \"affected\", \"version\": \"20.5.1.0.2\"}, {\"status\": \"affected\", \"version\": \"20.3.3.0.17\"}, {\"status\": \"affected\", \"version\": \"20.6.1.1\"}, {\"status\": \"affected\", \"version\": \"20.6.0.18.3\"}, {\"status\": \"affected\", \"version\": \"20.3.2.0.6\"}, {\"status\": \"affected\", \"version\": \"20.6.0.18.4\"}, {\"status\": \"affected\", \"version\": \"20.4.2.0.2\"}, {\"status\": \"affected\", \"version\": \"20.3.3.0.16\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.5\"}, {\"status\": \"affected\", \"version\": \"20.6.1.0.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.6\"}, {\"status\": \"affected\", \"version\": \"20.6.2\"}, {\"status\": \"affected\", \"version\": \"20.7.1EFT2\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.9\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.11\"}, {\"status\": \"affected\", \"version\": \"20.4.2.0.4\"}, {\"status\": \"affected\", \"version\": \"20.3.3.0.18\"}, {\"status\": \"affected\", \"version\": \"20.7.1\"}, {\"status\": \"affected\", \"version\": \"20.6.2.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4.1\"}, {\"status\": \"affected\", \"version\": \"20.5.1.1\"}, {\"status\": \"affected\", \"version\": \"20.4.2.1\"}, {\"status\": \"affected\", \"version\": \"20.4.2.1.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4.1.1\"}, {\"status\": \"affected\", \"version\": \"20.3.813\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.19\"}, {\"status\": \"affected\", \"version\": \"20.4.2.2.1\"}, {\"status\": \"affected\", \"version\": \"20.5.1.2\"}, {\"status\": \"affected\", \"version\": \"20.3.4.2\"}, {\"status\": \"affected\", \"version\": \"20.3.814\"}, {\"status\": \"affected\", \"version\": \"20.4.2.2\"}, {\"status\": \"affected\", \"version\": \"20.6.2.2\"}, {\"status\": \"affected\", \"version\": \"20.3.4.2.1\"}, {\"status\": \"affected\", \"version\": \"20.7.1.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4.1.2\"}, {\"status\": \"affected\", \"version\": \"20.6.2.2.2\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.20\"}, {\"status\": \"affected\", \"version\": \"20.6.2.2.3\"}, {\"status\": \"affected\", \"version\": \"20.4.2.2.2\"}, {\"status\": \"affected\", \"version\": \"20.3.5\"}, {\"status\": \"affected\", \"version\": \"20.6.2.0.4\"}, {\"status\": \"affected\", \"version\": \"20.4.2.2.3\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.24\"}, {\"status\": \"affected\", \"version\": \"20.6.2.2.7\"}, {\"status\": \"affected\", \"version\": \"20.6.3\"}, {\"status\": \"affected\", \"version\": \"20.3.4.2.2\"}, {\"status\": \"affected\", \"version\": \"20.4.2.2.4\"}, {\"status\": \"affected\", \"version\": \"20.7.1.0.2\"}, {\"status\": \"affected\", \"version\": \"20.8.1\"}, {\"status\": \"affected\", \"version\": \"20.3.5.0.8\"}, {\"status\": \"affected\", \"version\": \"20.3.5.0.9\"}, {\"status\": \"affected\", \"version\": \"20.4.2.2.8\"}, {\"status\": \"affected\", \"version\": \"20.3.5.0.7\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.7\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.5\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.10\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.2\"}, {\"status\": \"affected\", \"version\": \"20.7.2\"}, {\"status\": \"affected\", \"version\": \"20.9.1EFT2\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.11\"}, {\"status\": \"affected\", \"version\": \"20.6.3.1\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.14\"}, {\"status\": \"affected\", \"version\": \"20.6.4\"}, {\"status\": \"affected\", \"version\": \"20.9.1\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.19\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.18\"}, {\"status\": \"affected\", \"version\": \"20.3.6\"}, {\"status\": \"affected\", \"version\": \"20.9.1.1\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.23\"}, {\"status\": \"affected\", \"version\": \"20.6.4.0.4\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.25\"}, {\"status\": \"affected\", \"version\": \"20.6.5\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.27\"}, {\"status\": \"affected\", \"version\": \"20.9.2\"}, {\"status\": \"affected\", \"version\": \"20.9.2.1\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.29\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.31\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.32\"}, {\"status\": \"affected\", \"version\": \"20.10.1\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.33\"}, {\"status\": \"affected\", \"version\": \"20.9.2.0.01\"}, {\"status\": \"affected\", \"version\": \"20.9.1_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.10.1_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.9.2_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.3.7\"}, {\"status\": \"affected\", \"version\": \"20.9.3\"}, {\"status\": \"affected\", \"version\": \"20.6.5.1\"}, {\"status\": \"affected\", \"version\": \"20.11.1\"}, {\"status\": \"affected\", \"version\": \"20.11.1_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.9.3_LI_ Images\"}, {\"status\": \"affected\", \"version\": \"20.6.3.1.1\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.2\"}, {\"status\": \"affected\", \"version\": \"20.6.5.1.2\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.3\"}, {\"status\": \"affected\", \"version\": \"20.4.2.3\"}, {\"status\": \"affected\", \"version\": \"20.6.3.2\"}, {\"status\": \"affected\", \"version\": \"20.6.4.1\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.38\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.39\"}, {\"status\": \"affected\", \"version\": \"20.3.5.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4.3\"}, {\"status\": \"affected\", \"version\": \"20.9.3.1\"}, {\"status\": \"affected\", \"version\": \"20.3.3.2\"}, {\"status\": \"affected\", \"version\": \"20.6.5.2\"}, {\"status\": \"affected\", \"version\": \"20.3.7.1\"}, {\"status\": \"affected\", \"version\": \"20.10.1.1\"}, {\"status\": \"affected\", \"version\": \"20.6.5.2.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.25\"}, {\"status\": \"affected\", \"version\": \"20.6.2.2.4\"}, {\"status\": \"affected\", \"version\": \"20.6.1.2\"}, {\"status\": \"affected\", \"version\": \"20.11.1.1\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.5\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.26\"}, {\"status\": \"affected\", \"version\": \"20.6.5.1.3\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.40\"}, {\"status\": \"affected\", \"version\": \"20.1.3.1\"}, {\"status\": \"affected\", \"version\": \"20.9.2.2\"}, {\"status\": \"affected\", \"version\": \"20.6.5.2.3\"}, {\"status\": \"affected\", \"version\": \"20.6.5.1.4\"}, {\"status\": \"affected\", \"version\": \"20.6.5.3\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.41\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.7\"}, {\"status\": \"affected\", \"version\": \"20.6.5.1.5\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.4\"}, {\"status\": \"affected\", \"version\": \"20.6.4.0.19\"}, {\"status\": \"affected\", \"version\": \"20.6.5.1.6\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.8\"}, {\"status\": \"affected\", \"version\": \"20.6.3.3\"}, {\"status\": \"affected\", \"version\": \"20.3.7.2\"}, {\"status\": \"affected\", \"version\": \"20.6.5.4\"}, {\"status\": \"affected\", \"version\": \"20.6.5.1.7\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.12\"}, {\"status\": \"affected\", \"version\": \"20.6.4.2\"}, {\"status\": \"affected\", \"version\": \"20.6.5.5\"}, {\"status\": \"affected\", \"version\": \"20.9.3.2\"}, {\"status\": \"affected\", \"version\": \"20.11.1.2\"}, {\"status\": \"affected\", \"version\": \"20.6.3.4\"}, {\"status\": \"affected\", \"version\": \"20.10.1.2\"}, {\"status\": \"affected\", \"version\": \"20.6.5.1.9\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.16\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.45\"}, {\"status\": \"affected\", \"version\": \"20.6.5.1.10\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.17\"}, {\"status\": \"affected\", \"version\": \"20.6.5.2.4\"}, {\"status\": \"affected\", \"version\": \"20.6.4.0.21\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.18\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.46\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.47\"}, {\"status\": \"affected\", \"version\": \"20.9.2.3\"}, {\"status\": \"affected\", \"version\": \"20.9.3.2_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.21\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.20\"}, {\"status\": \"affected\", \"version\": \"20.9.4_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.9.4\"}, {\"status\": \"affected\", \"version\": \"20.6.5.1.11\"}, {\"status\": \"affected\", \"version\": \"20.12.1\"}, {\"status\": \"affected\", \"version\": \"20.12.1_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.6.5.1.13\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.23\"}, {\"status\": \"affected\", \"version\": \"20.6.5.2.8\"}, {\"status\": \"affected\", \"version\": \"20.9.4.1\"}, {\"status\": \"affected\", \"version\": \"20.9.4.1_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.25\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.24\"}, {\"status\": \"affected\", \"version\": \"20.6.5.1.14\"}, {\"status\": \"affected\", \"version\": \"20.3.8\"}, {\"status\": \"affected\", \"version\": \"20.6.6\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.26\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.51\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.29\"}, {\"status\": \"affected\", \"version\": \"20.12.2\"}, {\"status\": \"affected\", \"version\": \"20.12.2_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.6.6.0.1\"}, {\"status\": \"affected\", \"version\": \"20.13.1_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.9.4.0.4\"}, {\"status\": \"affected\", \"version\": \"20.13.1\"}, {\"status\": \"affected\", \"version\": \"20.9.4.1.1\"}, {\"status\": \"affected\", \"version\": \"20.9.5\"}, {\"status\": \"affected\", \"version\": \"20.9.5_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.12.3_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.12.3\"}, {\"status\": \"affected\", \"version\": \"20.9.4.1.3\"}, {\"status\": \"affected\", \"version\": \"20.6.7\"}, {\"status\": \"affected\", \"version\": \"20.9.5.1\"}, {\"status\": \"affected\", \"version\": \"20.9.5.1_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.9.4.1.6\"}, {\"status\": \"affected\", \"version\": \"20.14.1\"}, {\"status\": \"affected\", \"version\": \"20.14.1_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.9.5.2\"}, {\"status\": \"affected\", \"version\": \"20.9.5.2.1\"}, {\"status\": \"affected\", \"version\": \"20.9.5.2_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.12.3.1\"}, {\"status\": \"affected\", \"version\": \"20.12.4\"}, {\"status\": \"affected\", \"version\": \"20.15.1_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.15.1\"}, {\"status\": \"affected\", \"version\": \"20.9.5.1.4\"}, {\"status\": \"affected\", \"version\": \"20.9.5.2.7\"}, {\"status\": \"affected\", \"version\": \"20.9.5.2.13\"}, {\"status\": \"affected\", \"version\": \"20.9.6\"}, {\"status\": \"affected\", \"version\": \"20.9.6_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.9.5.2.14\"}, {\"status\": \"affected\", \"version\": \"20.6.8\"}, {\"status\": \"affected\", \"version\": \"20.12.4.0.03\"}, {\"status\": \"affected\", \"version\": \"20.16.1\"}, {\"status\": \"affected\", \"version\": \"20.16.1_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.12.4_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.9.5.2.16\"}, {\"status\": \"affected\", \"version\": \"20.12.4.0.4\"}, {\"status\": \"affected\", \"version\": \"20.12.401\"}, {\"status\": \"affected\", \"version\": \"20.9.5.3\"}, {\"status\": \"affected\", \"version\": \"20.9.5.3_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.12.4.1_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.12.4.1\"}, {\"status\": \"affected\", \"version\": \"20.9.5.2.21\"}, {\"status\": \"affected\", \"version\": \"20.9.6.0.3\"}, {\"status\": \"affected\", \"version\": \"20.12.4.0.6\"}, {\"status\": \"affected\", \"version\": \"20.15.2_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.15.2\"}, {\"status\": \"affected\", \"version\": \"20.12.4_Monthly_ES5\"}, {\"status\": \"affected\", \"version\": \"20.12.5\"}, {\"status\": \"affected\", \"version\": \"20.12.5_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.9.7_LI _Images\"}, {\"status\": \"affected\", \"version\": \"20.9.7\"}, {\"status\": \"affected\", \"version\": \"20.15.3\"}, {\"status\": \"affected\", \"version\": \"20.15.3_ LI _Images\"}, {\"status\": \"affected\", \"version\": \"20.12.501\"}, {\"status\": \"affected\", \"version\": \"20.12.5.1_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.12.5.1\"}, {\"status\": \"affected\", \"version\": \"20.12.5.2_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.12.5.2\"}, {\"status\": \"affected\", \"version\": \"20.15.3.1\"}, {\"status\": \"affected\", \"version\": \"20.15.4_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.15.4\"}, {\"status\": \"affected\", \"version\": \"20.9.7.1_LI _Images\"}, {\"status\": \"affected\", \"version\": \"20.9.7.1\"}, {\"status\": \"affected\", \"version\": \"20.18.1\"}, {\"status\": \"affected\", \"version\": \"20.18.1_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.12.6_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.12.6\"}, {\"status\": \"affected\", \"version\": \"20.12.5.1.01\"}, {\"status\": \"affected\", \"version\": \"20.9.8\"}, {\"status\": \"affected\", \"version\": \"20.9.8_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.18.2\"}, {\"status\": \"affected\", \"version\": \"20.15.4.1_LI_Images\"}, {\"status\": \"affected\", \"version\": \"20.15.4.1\"}, {\"status\": \"affected\", \"version\": \"20.18.2_LI_Images\"}], \"defaultStatus\": \"unknown\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v\", \"name\": \"cisco-sa-sdwan-authbp-qwCX8D4v\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system.\\r\\n\\r\\nThis vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system\u0026nbsp;and gain vmanage user privileges.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-648\", \"description\": \"Incorrect Use of Privileged APIs\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2026-02-25T16:17:57.583Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-20122\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-25T18:14:27.915Z\", \"dateReserved\": \"2025-10-08T11:59:15.377Z\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2026-02-25T16:14:21.256Z\", \"assignerShortName\": \"cisco\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CISCO-SA-SDWAN-AUTHBP-QWCX8D4V

Vulnerability from csaf_cisco - Published: 2026-02-25 16:00 - Updated: 2026-02-25 16:00

Summary

Cisco Catalyst SD-WAN Vulnerabilities

Notes

Summary

Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an attacker to access an affected system, elevate privileges to root, gain access to sensitive information, and overwrite arbitrary files. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

Vulnerable Products

These vulnerabilities affect Cisco Catalyst SD-WAN Manager, regardless of device configuration. For information about which Cisco software releases are vulnerable, see the Fixed Software ["#fs"] section of this advisory.

Products Confirmed Not Vulnerable

Only products listed in the Vulnerable Products ["#vp"] section of this advisory are known to be affected by these vulnerabilities. Cisco has confirmed that Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by the vulnerabilities that are described in CVE-2026-20128 and CVE-2026-20129.

Details

These vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit another vulnerability. Details about the vulnerabilities are as follows: CVE-2026-20129: Cisco Catalyst SD-WAN Manager Authentication Bypass Vulnerability A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected system as a user who has the netadmin role. The vulnerability is due to improper authentication for requests that are sent to the API. An attacker could exploit this vulnerability by sending a crafted request to the API of an affected system. A successful exploit could allow the attacker to execute commands with the privileges of the netadmin role. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Bug ID(s): CSCws33587 ["https://bst.cisco.com/bugsearch/bug/CSCws33587"] CVE ID: CVE-2026-20129 Security Impact Rating (SIR): Critical CVSS Base Score: 9.8 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2026-20126: Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system. This vulnerability is due to an insufficient user authentication mechanism in the REST API. An attacker could exploit this vulnerability by sending a request to the REST API of the affected system. A successful exploit could allow the attacker to gain root privileges on the underlying operating system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Bug ID(s): CSCws93470 ["https://bst.cisco.com/bugsearch/bug/CSCws93470"] CVE ID: CVE-2026-20126 Security Impact Rating (SIR): High CVSS Base Score: 7.8 CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2026-20133: Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability A vulnerability in Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system access restrictions. An attacker could exploit this vulnerability by accessing the API of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Bug ID(s): CSCws33583 ["https://bst.cisco.com/bugsearch/bug/CSCws33583"] CVE ID: CVE-2026-20133 Security Impact Rating (SIR): High CVSS Base Score: 7.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2026-20122: Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Bug ID(s): CSCws33584 ["https://bst.cisco.com/bugsearch/bug/CSCws33584"], CSCws33586 ["https://bst.cisco.com/bugsearch/bug/CSCws33586"] CVE ID: CVE-2026-20122 Security Impact Rating (SIR): High CVSS Base Score: 7.1 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L CVE-2026-20128: Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker to gain DCA user privileges on an affected system. To exploit this vulnerability, the attacker must have valid vmanage credentials on the affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by accessing the filesystem as a low-privileged user and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Bug ID(s): CSCws33585 ["https://bst.cisco.com/bugsearch/bug/CSCws33585"] CVE ID: CVE-2026-20128 Security Impact Rating (SIR): Medium CVSS Base Score: 5.5 CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Workarounds

There are no workarounds that address these vulnerabilities.

Fixed Software

Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate these vulnerabilities and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory. Fixed Releases In the following tables, the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerabilities that are described in this advisory and the first release that includes the fix for these vulnerabilities. Customers are advised to upgrade to an appropriate fixed software release ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"] as indicated in this section. Cisco Catalyst SD-WAN Manager Release First Fixed Release Earlier than 20.91 Migrate to a fixed release. 20.9 20.9.8.2 (Estimated release February 27, 2026) 20.111 20.12.6.1 20.12.5 20.12.6 20.12.5.3 20.12.6.1 20.131 20.15.4.2 20.141 20.15.4.2 20.15 20.15.4.2 20.161 20.18.2.1 20.18 20.18.2.1 1. These releases have reached End of Software Maintenance ["https://www.cisco.com/c/en/us/products/routers/sd-wan/eos-eol-notice-listing.html"]. Cisco strongly encourages customers to upgrade to a supported release ["https://www.cisco.com/c/en/us/td/docs/routers/sdwan/release/notes/compatibility-and-server-recommendations.html"]. The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory. Additional Information To check component and software release compatibility, see the SD-WAN Controller Component Compatibility Matrix ["https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/catalyst_sdwan_compatibility_matrix/index.html"]. For help planning an upgrade, Cisco Catalyst SD-WAN Upgrade Matrix ["https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/catalyst-sdwan-upgrade-matrix/index.html"].

Recommendations

Cisco recommends upgrading the affected systems to a fixed software release. General Recommendations for Hardening Prevent access from unsecured networks, such as the internet, to the system. If internet access to the system is required, restrict system access to only known, trusted hosts on ports/protocols that are included in the user guides. Protect Cisco Catalyst SD-WAN Control Components behind a filtering device such as a firewall, and filter traffic to and from the systems while allowing only known, trusted hosts to send traffic to the systems. Using a two-layer firewall can provide flexibility in network planning so that end users do not connect directly to the outer DMZ. See the Deployment sections of the User Guides for Cisco Catalyst SD-WAN software ["https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html#DeploymentPlanning"]. Regularly monitor web log traffic for any unexpected traffic to and from systems. Logging should be sent to an external server, if possible, and kept for a long enough duration so that post-event investigations can be performed with sufficient log data. Disable HTTP for the Cisco Catalyst SD-WAN Manager web UI administrator portal. Disable any network services that are not required, including HTTP and FTP. For more information about specific service functionality, see the Cisco Catalyst SD-WAN user guides. Upgrade the system to the latest version of Cisco Catalyst SD-WAN Software. Change the default administrator password to a more secure variant. Restrict access to the administrator account by creating user accounts based on necessary access requirements. In addition, create operator accounts for all administrators. Use SSL/TLS, obtain an SSL certificate from a certificate authority (CA), or create a self-signed certificate. For more information, review the Cisco Catalyst SD-WAN Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide"].

Vulnerability Policy

To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy ["http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Exploitation and Public Announcements

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.

Source

These vulnerabilities were found during internal security testing by Arthur Vidineyev of the Cisco Advanced Security Initiatives Group (ASIG).

Legal Disclaimer

SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT The Cisco Support and Downloads ["https://www.cisco.com/c/en/us/support/index.html"] page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid. Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC) ["https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"]. Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. When considering software upgrades ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"], customers are advised to regularly consult the advisories ["https://www.cisco.com/go/psirt"] for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) ["https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"] or their contracted maintenance providers. LEGAL DISCLAIMER DETAILS CISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. Copies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the Cisco Security Advisories ["https://www.cisco.com/go/psirt"] page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the Cisco Security Vulnerability Policy ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"] for more information.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "summary": "These vulnerabilities were found during internal security testing by Arthur Vidineyev of the Cisco Advanced Security Initiatives Group (ASIG)."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an attacker to access an affected system, elevate privileges to root, gain access to sensitive information, and overwrite arbitrary files.\r\n\r\nFor more information about these vulnerabilities, see the Details [\"#details\"] section of this advisory.\r\n\r\nCisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.\r\n\r\n",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "These vulnerabilities affect Cisco Catalyst SD-WAN Manager, regardless of device configuration.\r\n\r\nFor information about which Cisco software releases are vulnerable, see the Fixed Software [\"#fs\"] section of this advisory.",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by these vulnerabilities.\r\n\r\nCisco has confirmed that Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by the vulnerabilities that are described in CVE-2026-20128 and CVE-2026-20129.",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "These vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit another vulnerability.\r\n\r\nDetails about the vulnerabilities are as follows:\r\n\r\nCVE-2026-20129: Cisco Catalyst SD-WAN Manager Authentication Bypass Vulnerability\r\n\r\nA vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected system as a user who has the netadmin role.\r\n\r\nThe vulnerability is due to improper authentication for requests that are sent to the API. An attacker could exploit this vulnerability by sending a crafted request to the API of an affected system. A successful exploit could allow the attacker to execute commands with the privileges of the netadmin role.\r\n\r\nNote: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\nBug ID(s): CSCws33587 [\"https://bst.cisco.com/bugsearch/bug/CSCws33587\"]\r\nCVE ID: CVE-2026-20129\r\nSecurity Impact Rating (SIR): Critical\r\nCVSS Base Score: 9.8\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\r\n\r\nCVE-2026-20126: Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability\r\n\r\nA vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system.\r\n\r\nThis vulnerability is due to an insufficient user authentication mechanism in the REST API. An attacker could exploit this vulnerability by sending a request to the REST API of the affected system. A successful exploit could allow the attacker to gain root privileges on the underlying operating system.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\nBug ID(s): CSCws93470 [\"https://bst.cisco.com/bugsearch/bug/CSCws93470\"]\r\nCVE ID: CVE-2026-20126\r\nSecurity Impact Rating (SIR): High\r\nCVSS Base Score: 7.8\r\nCVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\r\n\r\nCVE-2026-20133: Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability\r\n\r\nA vulnerability in Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to view sensitive information on an affected system.\r\n\r\nThis vulnerability is due to insufficient file system access restrictions. An attacker could exploit this vulnerability by accessing the API of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\nBug ID(s): CSCws33583 [\"https://bst.cisco.com/bugsearch/bug/CSCws33583\"]\r\nCVE ID: CVE-2026-20133\r\nSecurity Impact Rating (SIR): High\r\nCVSS Base Score: 7.5\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\r\n\r\nCVE-2026-20122: Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability\r\n\r\nA vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system.\r\n\r\nThis vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\nBug ID(s): CSCws33584 [\"https://bst.cisco.com/bugsearch/bug/CSCws33584\"], CSCws33586 [\"https://bst.cisco.com/bugsearch/bug/CSCws33586\"]\r\nCVE ID: CVE-2026-20122\r\nSecurity Impact Rating (SIR): High\r\nCVSS Base Score: 7.1\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L\r\n\r\nCVE-2026-20128: Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability\r\n\r\nA vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker to gain DCA user privileges on an affected system. To exploit this vulnerability, the attacker must have valid vmanage credentials on the affected system.\r\n\r\nThis vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by accessing the filesystem as a low-privileged user and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges.\r\n\r\nNote: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\nBug ID(s): CSCws33585 [\"https://bst.cisco.com/bugsearch/bug/CSCws33585\"]\r\nCVE ID: CVE-2026-20128\r\nSecurity Impact Rating (SIR): Medium\r\nCVSS Base Score: 5.5\r\nCVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
        "title": "Details"
      },
      {
        "category": "general",
        "text": "There are no workarounds that address these vulnerabilities.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate these vulnerabilities and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.\r\n      Fixed Releases\r\nIn the following tables, the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerabilities that are described in this advisory and the first release that includes the fix for these vulnerabilities. Customers are advised to upgrade to an appropriate fixed software release [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"] as indicated in this section.\r\n        Cisco Catalyst SD-WAN Manager Release  First Fixed Release          Earlier than 20.91  Migrate to a fixed release.      20.9  20.9.8.2 (Estimated release February 27, 2026)      20.111  20.12.6.1      20.12.5\r\n20.12.6  20.12.5.3\r\n20.12.6.1      20.131  20.15.4.2      20.141  20.15.4.2      20.15  20.15.4.2      20.161  20.18.2.1      20.18  20.18.2.1\r\n1. These releases have reached End of Software Maintenance [\"https://www.cisco.com/c/en/us/products/routers/sd-wan/eos-eol-notice-listing.html\"]. Cisco strongly encourages customers to upgrade to a supported release [\"https://www.cisco.com/c/en/us/td/docs/routers/sdwan/release/notes/compatibility-and-server-recommendations.html\"].\r\nThe Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.\r\n\r\nAdditional Information\r\n\r\nTo check component and software release compatibility, see the SD-WAN Controller Component Compatibility Matrix [\"https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/catalyst_sdwan_compatibility_matrix/index.html\"].\r\nFor help planning an upgrade, Cisco Catalyst SD-WAN Upgrade Matrix [\"https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/catalyst-sdwan-upgrade-matrix/index.html\"].",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "Cisco recommends upgrading the affected systems to a fixed software release.\r\n\r\nGeneral Recommendations for Hardening\r\n\r\nPrevent access from unsecured networks, such as the internet, to the system. If internet access to the system is required, restrict system access to only known, trusted hosts on ports/protocols that are included in the user guides.\r\nProtect Cisco Catalyst SD-WAN Control Components behind a filtering device such as a firewall, and filter traffic to and from the systems while allowing only known, trusted hosts to send traffic to the systems. Using a two-layer firewall can provide flexibility in network planning so that end users do not connect directly to the outer DMZ. See the Deployment sections of the User Guides for Cisco Catalyst SD-WAN software [\"https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html#DeploymentPlanning\"].\r\nRegularly monitor web log traffic for any unexpected traffic to and from systems. Logging should be sent to an external server, if possible, and kept for a long enough duration so that post-event investigations can be performed with sufficient log data.\r\nDisable HTTP for the Cisco Catalyst SD-WAN Manager web UI administrator portal.\r\nDisable any network services that are not required, including HTTP and FTP. For more information about specific service functionality, see the Cisco Catalyst SD-WAN user guides.\r\nUpgrade the system to the latest version of Cisco Catalyst SD-WAN Software.\r\nChange the default administrator password to a more secure variant. Restrict access to the administrator account by creating user accounts based on necessary access requirements. In addition, create operator accounts for all administrators.\r\nUse SSL/TLS, obtain an SSL certificate from a certificate authority (CA), or create a self-signed certificate.\r\n\r\nFor more information, review the Cisco Catalyst SD-WAN Hardening Guide [\"https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide\"].",
        "title": "Recommendations"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "These vulnerabilities were found during internal security testing by Arthur Vidineyev of the Cisco Advanced Security Initiatives Group (ASIG).",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT\r\n\r\nThe Cisco Support and Downloads [\"https://www.cisco.com/c/en/us/support/index.html\"] page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid.\r\n\r\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]. Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories [\"https://www.cisco.com/go/psirt\"] for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"] or their contracted maintenance providers.\r\n    LEGAL DISCLAIMER DETAILS\r\n\r\nCISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nCopies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the Cisco Security Advisories [\"https://www.cisco.com/go/psirt\"] page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the Cisco Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"] for more information.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@cisco.com",
      "issuing_authority": "Cisco PSIRT",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Cisco Catalyst SD-WAN Vulnerabilities",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "CSCws33587",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCws33587"
      },
      {
        "category": "external",
        "summary": "CSCws93470",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCws93470"
      },
      {
        "category": "external",
        "summary": "CSCws33583",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCws33583"
      },
      {
        "category": "external",
        "summary": "CSCws33584",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCws33584"
      },
      {
        "category": "external",
        "summary": "CSCws33586",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCws33586"
      },
      {
        "category": "external",
        "summary": "CSCws33585",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCws33585"
      },
      {
        "category": "external",
        "summary": "fixed software release",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "End of Software Maintenance",
        "url": "https://www.cisco.com/c/en/us/products/routers/sd-wan/eos-eol-notice-listing.html"
      },
      {
        "category": "external",
        "summary": "supported release",
        "url": "https://www.cisco.com/c/en/us/td/docs/routers/sdwan/release/notes/compatibility-and-server-recommendations.html"
      },
      {
        "category": "external",
        "summary": "SD-WAN Controller Component Compatibility Matrix",
        "url": "https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/catalyst_sdwan_compatibility_matrix/index.html"
      },
      {
        "category": "external",
        "summary": "Cisco Catalyst SD-WAN Upgrade Matrix",
        "url": "https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/catalyst-sdwan-upgrade-matrix/index.html"
      },
      {
        "category": "external",
        "summary": "Deployment sections of the User Guides for Cisco Catalyst SD-WAN software",
        "url": "https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html#DeploymentPlanning"
      },
      {
        "category": "external",
        "summary": "Cisco Catalyst SD-WAN Hardening Guide",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "Cisco Support and Downloads",
        "url": "https://www.cisco.com/c/en/us/support/index.html"
      },
      {
        "category": "external",
        "summary": "Cisco Technical Assistance Center (TAC)",
        "url": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"
      },
      {
        "category": "external",
        "summary": "the advisories",
        "url": "https://www.cisco.com/go/psirt"
      }
    ],
    "title": "Cisco Catalyst SD-WAN Vulnerabilities",
    "tracking": {
      "current_release_date": "2026-02-25T16:00:00+00:00",
      "generator": {
        "date": "2026-02-25T16:00:13+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-sdwan-authbp-qwCX8D4v",
      "initial_release_date": "2026-02-25T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-02-25T15:59:38+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Cisco Catalyst SD-WAN Manager",
            "product": {
              "name": "Cisco Catalyst SD-WAN Manager ",
              "product_id": "CSAFPID-271450"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-20122",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCws33584"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCws33586"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-271450"
        ]
      },
      "release_date": "2026-02-25T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-271450"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-271450"
          ]
        }
      ],
      "title": "Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability"
    },
    {
      "cve": "CVE-2026-20126",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCws93470"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-271450"
        ]
      },
      "release_date": "2026-02-25T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-271450"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-271450"
          ]
        }
      ],
      "title": "Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability"
    },
    {
      "cve": "CVE-2026-20128",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCws33585"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-271450"
        ]
      },
      "release_date": "2026-02-25T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-271450"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-271450"
          ]
        }
      ],
      "title": "Cisco Catalyst SD-WAN Manager Static Credential Vulnerability"
    },
    {
      "cve": "CVE-2026-20129",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCws33587"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-271450"
        ]
      },
      "release_date": "2026-02-25T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-271450"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-271450"
          ]
        }
      ],
      "title": "Cisco Catayst SD-WAN Authentication Bypass Vulnerability"
    },
    {
      "cve": "CVE-2026-20133",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCws33583"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-271450"
        ]
      },
      "release_date": "2026-02-25T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-271450"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-271450"
          ]
        }
      ],
      "title": "Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability"
    }
  ]
}

GHSA-9QPV-49Q8-9CHX

Vulnerability from github – Published: 2026-02-25 18:31 – Updated: 2026-02-25 18:31

Details

This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

Severity ?

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-20122"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-648"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-25T17:25:28Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system.\n\nThis vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system\u0026nbsp;and gain vmanage user privileges.",
  "id": "GHSA-9qpv-49q8-9chx",
  "modified": "2026-02-25T18:31:38Z",
  "published": "2026-02-25T18:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20122"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2026-0071

Vulnerability from csaf_ncscnl - Published: 2026-02-25 17:11 - Updated: 2026-02-25 17:11

Summary

Kwetsbaarheden verholpen in Cisco Catalyst SD-WAN Manager

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

Cisco heeft meerdere kwetsbaarheden verholpen in de Cisco Catalyst SD-WAN Manager.

Interpretaties

De kwetsbaarheden bevinden zich in de peering authenticatiemechanismen van de Cisco Catalyst SD-WAN Controller en Manager producten. Deze kwetsbaarheden stellen een niet-geauthenticeerde externe aanvaller in staat om het authenticatieproces te omzeilen, waardoor administratieve privileges op de getroffen systemen kunnen worden verkregen. Daarnaast kunnen aanvallers root-level privileges verkrijgen, wat kan leiden tot ongeautoriseerde toegang tot gevoelige informatie en de mogelijkheid om willekeurige bestanden te overschrijven, wat kan resulteren in verdere exploitatie of systeeminstabiliteit. De meest ernstige kwetsbaarheid, met kenmerk CVE-2026-20127, kan door een ongeauthenticeerde kwaadwillende worden misbruikt om op afstand willekeurige code uit te voeren met hoge administratieve rechten. Cisco geeft aan dat actief misbruik van deze kwetsbaarheid bekend is. Na misbruik van deze kwetsbaarheid zou de kwaadwillende de kwetsbaarheid met kenmerk CVE-2022-20775 gebruiken om de rechten te escaleren tot root. Dit doet de actor door het systeem te downgraden naar een versie waarin CVE-2022-20775 niet verholpen is, de rechten middels deze kwetsbaarheid te verhogen naar root en vervolgens het systeem weer terug te zetten in de oorspronkelijke versie. Het NCSC verwacht op korte termijn een publieke PoC en grootschalige pogingen tot misbruik van CVE-2026-20127. Het NCSC adviseert met klem de update zo spoedig mogelijk te installeren.

Oplossingen

Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. In een blog geeft Talos informatie over het bekende misbruik en is er een validatie checklist beschikbaar gesteld met uitleg hoe deze kan worden toegepast. Zie bijgevoegde referenties voor meer informatie.

Kans

high

Schade

high

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-257

Storing Passwords in a Recoverable Format

CWE-287

Improper Authentication

CWE-648

Incorrect Use of Privileged APIs

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Cisco heeft meerdere kwetsbaarheden verholpen in de Cisco Catalyst SD-WAN Manager.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden bevinden zich in de peering authenticatiemechanismen van de Cisco Catalyst SD-WAN Controller en Manager producten. Deze kwetsbaarheden stellen een niet-geauthenticeerde externe aanvaller in staat om het authenticatieproces te omzeilen, waardoor administratieve privileges op de getroffen systemen kunnen worden verkregen. Daarnaast kunnen aanvallers root-level privileges verkrijgen, wat kan leiden tot ongeautoriseerde toegang tot gevoelige informatie en de mogelijkheid om willekeurige bestanden te overschrijven, wat kan resulteren in verdere exploitatie of systeeminstabiliteit.\n\nDe meest ernstige kwetsbaarheid, met kenmerk CVE-2026-20127, kan door een ongeauthenticeerde kwaadwillende worden misbruikt om op afstand willekeurige code uit te voeren met hoge administratieve rechten. Cisco geeft aan dat actief misbruik van deze kwetsbaarheid bekend is.\n\nNa misbruik van deze kwetsbaarheid zou de kwaadwillende de kwetsbaarheid met kenmerk CVE-2022-20775 gebruiken om de rechten te escaleren tot root. Dit doet de actor door het systeem te downgraden naar een versie waarin CVE-2022-20775 niet verholpen is, de rechten middels deze kwetsbaarheid te verhogen naar root en vervolgens het systeem weer terug te zetten in de oorspronkelijke versie.\n\nHet NCSC verwacht op korte termijn een publieke PoC en grootschalige pogingen tot misbruik van CVE-2026-20127. Het NCSC adviseert met klem de update zo spoedig mogelijk te installeren.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. In een blog geeft Talos informatie over het bekende misbruik en is er een validatie checklist  beschikbaar gesteld met uitleg hoe deze kan worden toegepast. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      },
      {
        "category": "general",
        "text": "Storing Passwords in a Recoverable Format",
        "title": "CWE-257"
      },
      {
        "category": "general",
        "text": "Improper Authentication",
        "title": "CWE-287"
      },
      {
        "category": "general",
        "text": "Incorrect Use of Privileged APIs",
        "title": "CWE-648"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://blog.talosintelligence.com/uat-8616-sd-wan"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Cisco Catalyst SD-WAN Manager",
    "tracking": {
      "current_release_date": "2026-02-25T17:11:09.013125Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0071",
      "initial_release_date": "2026-02-25T17:11:09.013125Z",
      "revision_history": [
        {
          "date": "2026-02-25T17:11:09.013125Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Catalyst SD-WAN Manager"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Cisco Catalyst SD-WAN"
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-20122",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager could enable attackers to gain root privileges, access sensitive data, and overwrite arbitrary files, posing significant security risks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20122 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20122.json"
        }
      ],
      "title": "CVE-2026-20122"
    },
    {
      "cve": "CVE-2026-20126",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager could enable attackers to gain root privileges, access sensitive data, and overwrite arbitrary files, posing significant security risks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20126 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20126.json"
        }
      ],
      "title": "CVE-2026-20126"
    },
    {
      "cve": "CVE-2026-20127",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "description",
          "text": "A vulnerability in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller and Manager allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20127 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20127.json"
        }
      ],
      "title": "CVE-2026-20127"
    },
    {
      "cve": "CVE-2026-20128",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager could enable attackers to gain root privileges, access sensitive data, and overwrite arbitrary files, posing significant security risks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20128 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20128.json"
        }
      ],
      "title": "CVE-2026-20128"
    },
    {
      "cve": "CVE-2026-20129",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager could enable attackers to gain root privileges, access sensitive data, and overwrite arbitrary files, posing significant security risks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20129 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20129.json"
        }
      ],
      "title": "CVE-2026-20129"
    },
    {
      "cve": "CVE-2026-20133",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Storing Passwords in a Recoverable Format",
          "title": "CWE-257"
        },
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Incorrect Use of Privileged APIs",
          "title": "CWE-648"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager could enable attackers to gain root privileges, access sensitive data, and overwrite arbitrary files, posing significant security risks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20133 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20133.json"
        }
      ],
      "title": "CVE-2026-20133"
    }
  ]
}

FKIE_CVE-2026-20122

Vulnerability from fkie_nvd - Published: 2026-02-25 17:25 - Updated: 2026-02-25 17:25

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

References

	URL	Tags
	psirt@cisco.com	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system.\r\n\r\nThis vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system\u0026nbsp;and gain vmanage user privileges."
    }
  ],
  "id": "CVE-2026-20122",
  "lastModified": "2026-02-25T17:25:28.170",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "psirt@cisco.com",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-02-25T17:25:28.170",
  "references": [
    {
      "source": "psirt@cisco.com",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-648"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Primary"
    }
  ]
}

CERTFR-2026-AVI-0210

Vulnerability from certfr_avis - Published: 2026-02-25 - Updated: 2026-02-25

De multiples vulnérabilités ont été découvertes dans Cisco Catalyst SD-WAN. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.

Cisco indique que la vulnérabilité CVE-2026-20127 est activement exploitée.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Cisco indique que la publication de la version corrective 20.9.8.2 pour Catalyst SD-WAN et Catalyst SD-WAN Manager est prévue le 27 février 2026. Les versions 20.11.x, 20.13.x, 20.14.x et 20.16.x sont affectées par les vulnérabilités mais ne bénéficieront pas de correctifs de sécurité car elles ont atteint la fin de période de maintenance. Le CERT-FR recommande de migrer vers une version maintenue et avec les derniers correctifs de sécurité.

L'éditeur précise aussi que la solution Cisco SD-WAN a été renommée Cisco Catalyst SD-WAN. Les avis éditeurs indiquent également d'autres changements de noms pour les composants de cette solution.

Impacted products

Vendor	Product	Description
Cisco	Catalyst SD-WAN	Catalyst SD-WAN et Catalyst SD-WAN Manager versions antérieures à 20.9.8.2
Cisco	Catalyst SD-WAN	Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.12.6.x antérieures à 20.12.6.1
Cisco	Catalyst SD-WAN	Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.15.x antérieures à 20.15.4.2
Cisco	Catalyst SD-WAN	Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.18.x antérieures à 20.18.2.1
Cisco	Catalyst SD-WAN	Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.12.5.x antérieures à 20.12.5.3

References

Title

Publication Time

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-20122 (GCVE-0-2026-20122)

CISCO-SA-SDWAN-AUTHBP-QWCX8D4V

GHSA-9QPV-49Q8-9CHX

NCSC-2026-0071

FKIE_CVE-2026-20122

CERTFR-2026-AVI-0210

Solutions

Tags

Sightings

Nomenclature