{"id":"CVE-2026-20128","kind":"vulnerability","aliases":["CVE-2026-20128"],"related":[],"title":"A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an…","description":"Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.\n\nCISA required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","summary":"Cisco Catalyst SD-WAN Manager stores the DCA user's password in a recoverable format on the filesystem. An attacker with a low-privileged local account can read that credential file and gain DCA user privileges.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2026-04-20T00:00:00+00:00","products":[{"name":"cisco catalyst sd-wan manager","fixed":["20.9.8.2"],"affected":"< 20.9.8.2","ecosystem":"vendor"},{"name":"cisco catalyst sd-wan manager","fixed":["20.12.5.3"],"affected":">= 20.10, < 20.12.5.3","ecosystem":"vendor"},{"name":"cisco catalyst sd-wan manager","fixed":["20.15.4.2"],"affected":">= 20.13, < 20.15.4.2","ecosystem":"vendor"},{"name":"cisco catalyst sd-wan manager","fixed":["20.18"],"affected":">= 20.16, < 20.18","ecosystem":"vendor"},{"name":"cisco catalyst sd-wan manager","fixed":[],"affected":"= 20.12.6","ecosystem":"vendor"},{"name":"Cisco Catalyst SD-WAN Manager","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["catalyst-sd-wan","cisco","exploited","sd-wan-manager","vendor"],"not_affected_if":["no-sd-wan-manager-deployed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-02-25T17:25:30+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:38:45+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T20:38:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","summary":"Cisco Catalyst SD-WAN Manager stores the DCA user's password in a recoverable format on the filesystem. An attacker with a low-privileged local account can read that credential file and gain DCA user privileges.","category":"vendor","who_cares":["cisco","catalyst-sd-wan","sd-wan-manager"],"confidence":0.7,"needs_auth":"yes","worst_case":"Local low-privileged user escalates to DCA user privileges by reading a credential file.","analyst_note":"Actively exploited per CISA KEV; find Cisco's advisory and the CISA Emergency Directive 26-03 and Hunt & Hardening guidance for fixed versions, detection steps and mitigations.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-sd-wan-manager-deployed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000443,"input_tokens":2712,"output_tokens":344,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':213C '-03':184C '-20128':21A,24A '-2026':20A,23A '22':212C '26':183C 'access':137C 'account':99B 'action':156C 'adher':158C,207C 'agent':7A 'allow':18A,126C 'applic':210C 'assess':164C 'associ':169C 'attack':92B,130C 'authent':128C 'avail':228C 'bod':211C 'catalyst':12A,26A,32A,38A,44A,50A,56A,62B,73B,111C 'catalyst-sd-wan':61B 'cisa':154C,160C,179C,191C 'cisco':11A,25A,31A,37A,43A,49A,55A,65B,72B,110C,171C,197C 'cloud':216C 'collect':6A 'contain':116C 'could':17A 'credenti':103B,139C 'cve':19A,22A 'data':5A 'dca':8A,80B,107B,133C,143C 'devic':175C,201C 'direct':182C 'discontinu':219C 'emerg':181C 'exploit':66B 'exposur':165C 'featur':9A 'file':104B,140C 'filesystem':90B,147C 'format':87B,123C 'gain':106B,132C 'guidanc':195C,214C 'guidelin':162C 'harden':194C 'hunt':193C 'list':186C,203C 'local':98B,129C 'low':96B,151C 'low-privileg':95B,150C 'manag':16A,70B,77B,115C 'manager':30A,36A,42A,48A,54A,60A 'mitig':167C,225C 'note':189C,206C 'outlin':177C 'password':83B,119C 'pleas':157C 'privileg':97B,109B,135C,152C 'product':223C 'read':101B 'recover':86B,122C 'requir':155C 'risk':168C 'sd':14A,28A,34A,40A,46A,52A,58A,63B,68B,75B,113C,173C,199C 'sd-wan':13A,27A,33A,39A,45A,51A,57A,74B,112C,172C,198C 'sd-wan-manag':67B 'servic':217C 'store':78B,118C 'url':185C,202C 'use':220C 'user':81B,108B,134C,144C,153C 'vendor':71B 'vulner':2A,124C 'wan':15A,29A,35A,41A,47A,53A,59A,64B,69B,76B,114C,174C,200C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-02-25T17:25:30+00:00","kev":{"dateAdded":"2026-04-20","dueDate":"2026-04-23","requiredAction":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-20128","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20128","severity":null,"published_at":"2026-04-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-20128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20128","severity":null,"published_at":"2026-02-25T17:25:30+00:00","modified_at":"2026-06-17T10:17:10+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}