{"id":"CVE-2026-20133","kind":"vulnerability","aliases":["CVE-2026-20133"],"related":[],"title":"cisco catalyst sd-wan manager: A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive…","description":"Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.\n\nCISA required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","summary":"Cisco Catalyst SD-WAN Manager has a flaw that lets a remote attacker view sensitive information on the affected system. CISA lists it as actively exploited in the wild.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2026-04-20T00:00:00+00:00","products":[{"name":"cisco catalyst sd-wan manager","fixed":["20.9.8.2"],"affected":"< 20.9.8.2","ecosystem":"vendor"},{"name":"cisco catalyst sd-wan manager","fixed":["20.12.5.3"],"affected":">= 20.10, < 20.12.5.3","ecosystem":"vendor"},{"name":"cisco catalyst sd-wan manager","fixed":["20.15.4.2"],"affected":">= 20.13, < 20.15.4.2","ecosystem":"vendor"},{"name":"cisco catalyst sd-wan manager","fixed":["20.18.2.1"],"affected":">= 20.16, < 20.18.2.1","ecosystem":"vendor"},{"name":"cisco catalyst sd-wan manager","fixed":[],"affected":"= 20.12.6","ecosystem":"vendor"},{"name":"Cisco Catalyst SD-WAN Manager","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","exploited","infrastructure","sd-wan","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Follow CISA Emergency Directive 26-03 and the CISA Hunt & Hardening Guidance for Cisco SD-WAN Devices; the fixed version is unknown from these sources.","status":"open","published_at":"2026-02-25T17:25:30+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:38:44+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:38:44Z","model":"claude-haiku-5-5","output":{"fix":"Follow CISA Emergency Directive 26-03 and the CISA Hunt & Hardening Guidance for Cisco SD-WAN Devices; the fixed version is unknown from these sources.","reach":"internet","summary":"Cisco Catalyst SD-WAN Manager has a flaw that lets a remote attacker view sensitive information on the affected system. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["cisco","sd-wan","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote attacker reads sensitive information from the SD-WAN Manager, possibly including credentials.","analyst_note":"Find the affected and fixed Cisco versions and the hunt steps in CISA ED 26-03 and the Hunt & Hardening Guidance (URLs in the CISA KEV notes) and the Cisco advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000466,"input_tokens":2695,"output_tokens":392,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':194C '-03':165C '-20133':27A,30A '-2026':26A,29A '22':193C '26':164C 'action':137C 'activ':101B 'actor':121C 'adher':139C,188C 'affect':95B,133C 'allow':17A,125C 'applic':191C 'assess':145C 'associ':150C 'attack':21A,89B,127C 'avail':209C 'bod':192C 'catalyst':2A,11A,32A,38A,44A,50A,56A,62A,77B,107C 'cisa':97B,135C,141C,160C,172C 'cisco':1A,10A,31A,37A,43A,49A,55A,61A,67B,76B,106C,152C,178C 'cloud':197C 'contain':112C 'could':16A,124C 'cve':25A,28A 'devic':156C,182C 'direct':163C 'discontinu':200C 'emerg':162C 'exploit':68B,102B 'exposur':114C,146C 'flaw':84B 'guidanc':176C,195C 'guidelin':143C 'harden':175C 'host':75B 'hunt':174C 'inform':92B,117C,131C 'infrastructur':69B 'let':86B 'list':98B,167C,184C 'manag':6A,81B,111C 'manager':36A,42A,48A,54A,60A,66A 'mitig':148C,206C 'note':170C,187C 'outlin':158C 'pleas':138C 'product':204C 'remot':20A,88B,126C 'requir':136C 'risk':149C 'sd':4A,13A,34A,40A,46A,52A,58A,64A,71B,79B,109C,154C,180C 'sd-wan':3A,12A,33A,39A,45A,51A,57A,63A,70B,78B,108C,153C,179C 'self':74B 'self-host':73B 'sensit':24A,91B,116C,130C 'servic':198C 'softwar':15A 'system':96B,134C 'unauthent':19A 'unauthor':120C 'url':166C,183C 'use':201C 'view':23A,90B,129C 'vulner':8A,122C 'wan':5A,14A,35A,41A,47A,53A,59A,65A,72B,80B,110C,155C,181C 'wild':105B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-02-25T17:25:30+00:00","kev":{"dateAdded":"2026-04-20","dueDate":"2026-04-23","requiredAction":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-20133","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20133","severity":null,"published_at":"2026-04-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-20133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20133","severity":null,"published_at":"2026-02-25T17:25:30+00:00","modified_at":"2026-06-17T10:17:11+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}