Cisco Catalyst SD-WAN Manager: Information disclosure via API
Deadline for US federal agencies: 23 Apr 2026
Summary
Cisco Catalyst SD-WAN Manager (formerly vManage) contains an insufficient file system access restriction that allows an unauthenticated remote attacker to read sensitive information on the underlying operating system through the API. Cisco reports active exploitation, and CISA has listed the flaw in its Known Exploited Vulnerabilities catalog. One supplied description also mentions access by an authenticated netadmin user via vshell, but this wording does not appear in Cisco's advisory, so it should be verified against the advisory.
Affected
- Per the CVE record: 17.2.4 to 17.2.10 and 18.3.1.1 to 18.3.5 (verify the exact builds against the Cisco advisory)
- Cisco states that releases 20.18 and later are not affected (verify in the advisory)
Fixed in
Unknown. Cisco has released fixed software; the per-release fix for this CVE must be confirmed in the Cisco advisory table. Secondary sources list 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2 and 20.18.2.1, but the mapping to CVE-2026-20133 is not confirmed.
Workaround
- No workarounds available according to Cisco.
- Restrict access to the management interface and API to dedicated management networks (general hardening, not verified by Cisco).
Exploitation
- Cisco PSIRT became aware of active exploitation in April 2026.
- CISA KEV: added 2026-04-20, due date 2026-04-23.
- Public proof of concept: Unknown.
- Ransomware use: Unknown.
Our recommendation
- Inventory all Catalyst SD-WAN Manager instances and their exact versions.
- Upgrade to the fixed release for your train as listed in the Cisco advisory.
- Ensure the management UI and API are not reachable from the internet.
- Review logs for unauthenticated or unusual API access and treat any sign of compromise as an incident.
- Follow CISA guidance for Cisco SD-WAN and re-check the advisory for updates.
- If you do not operate Catalyst SD-WAN Manager, no action is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory cisco-sa-sdwan-authbp-qwCX8D4v sec.cloudapps.cisco.com
- CISA Known Exploited Vulnerabilities Catalog entry CVE-2026-20133 www.cisa.gov
- CISA alert: eight known exploited vulnerabilities added to catalog www.cisa.gov
- Help Net Security: CISA flags Cisco Catalyst SD-WAN Manager bug as exploited www.helpnetsecurity.com
- Deepwatch customer advisory on Cisco SD-WAN active exploitation www.deepwatch.com
- Hivepro threat advisory on actively exploited Catalyst SD-WAN Manager flaws www.hivepro.com
- CIRCL CVE record CVE-2026-20133 cve.circl.lu
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:02.
Original description (NVD)
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.
Required action (CISA)
Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.