CVE-2026-20128

Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN Manager versions prior to 20.18

Description A flaw exists in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager. This issue could allow an authenticated, local attacker with valid vmanage credentials to obtain DCA user privileges on a vulnerable system. The root cause is the storage of DCA user credentials in a recoverable format within a credential file on the affected system. An attacker with low-privileged access to the filesystem can read this file and extract the DCA password. Successful exploitation could enable the attacker to access other affected systems and gain DCA user privileges.

Recommendations Upgrade to Cisco Catalyst SD-WAN Manager version 20.18 or later.