IT SBIT Services
Schneeberger
DEEN
CVE tracker

Cisco Catalyst SD-WAN Manager: Recoverable storage of DCA user credentials

CVE-2026-20128High 7.5Actively exploited

← All vulnerabilities

Actively exploited – in the CISA catalogue of Known Exploited Vulnerabilities since 20 Apr 2026
Deadline for US federal agencies: 23 Apr 2026

Summary

Cisco Catalyst SD-WAN Manager stores the password of the Data Collection Agent (DCA) user in a recoverable format, in a credential file on the filesystem. An attacker with valid low-privileged access to the Manager can read this file and obtain DCA user privileges, which can then be used against other affected Manager systems. Cisco has confirmed active exploitation, and CISA lists the flaw in its KEV catalog. Note: the original report described an unauthenticated remote attacker, but the current NVD and CISA KEV descriptions describe an authenticated local attacker, which is the version used here.

Affected

  • Cisco Catalyst SD-WAN Manager releases earlier than 20.18
  • The CNA record lists affected versions including 18.3.6, 18.3.7, 18.4.4, 18.4.5, 19.2.0, 19.3.0, 20.1.1 and 20.1.12; default status unknown
  • Releases 20.18 and later are not affected

Fixed in

Unknown. See the fixed software section of the Cisco advisory for the exact release per branch. Unverified secondary reporting lists 20.9.8.2, 20.12.6.1 and 20.15.4.2.

Workaround

  • None. Cisco states there are no workarounds that address this vulnerability.

Exploitation

  • Cisco PSIRT has been aware of active exploitation since March 2026.
  • CISA added the CVE to KEV on 2026-04-20 with a federal due date of 2026-04-23.
  • Public proof-of-concept code is reported by secondary sources only; not verified.

Our recommendation

  • Inventory all SD-WAN Manager instances and their versions; review everything earlier than 20.18.
  • Upgrade to a fixed release listed in Cisco's advisory, prioritising systems that are exposed or in use.
  • Restrict management access to trusted administrative networks and review accounts with low privileges.
  • Check for indicators of compromise following Cisco's and CISA's hunting guidance, and rotate DCA and other Manager credentials if compromise is possible.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:01.

Original description (NVD)

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.

Required action (CISA)

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed