CVE-2026-20128: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 20 Apr 2026, 54 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 7.3%
EPSS score, percentile 94.4 of all scored records
- How severe?
- 7.5 High
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA deadline 23 Apr 2026. Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed … Full text
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- 20.1.12
- 19.2.1
- 18.4.4
- 18.4.5
- 20.1.1.1
- 20.1.1
and 6 more in the table below
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
CISA due date for this action: 23 April 2026.
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Linked from CISA's catalog entry
- https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems
- https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v
- https://nvd.nist.gov/vuln/detail/CVE-2026-20128
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | 20.1.12 |
| Affected | 19.2.1 |
| Affected | 18.4.4 |
| Affected | 18.4.5 |
| Affected | 20.1.1.1 |
| Affected | 20.1.1 |
| Affected | 19.3.0 |
| Affected | 19.2.2 |
| Affected | 19.2.099 |
| Affected | 18.3.6 |
| Affected | 18.3.7 |
| Affected | 19.2.0 |
Versions not listed are: unknown.
And 124 more version entries in the CVE record.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2026-20128 to its Known Exploited Vulnerabilities (KEV) catalog on 20 Apr 2026.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 23 Apr 2026.
- The CVE record was published on 25 Feb 2026, 54 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 7.5 (High), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 7.3% (percentile 94.4), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 25 Feb 2026 | CVE record published |
| 20 Apr 2026 | Added to CISA KEV |
| 21 Apr 2026 | CVE record last updated |
| 23 Apr 2026 | CISA due date for the required action |
References
More exploited Cisco vulnerabilities
- CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
- CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
- CVE-2026-76460: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
- CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability
- CVE-2026-20079: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability