PT-2026-21953 · Cisco · Cisco Catalyst Sd-Wan Manager

Arthur Vidineyev · Published 2026-02-25 · Updated 2026-03-05 · CVE-2026-20126

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN Manager (affected versions not specified)

Description A flaw exists in Cisco Catalyst SD-WAN Manager that could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system. This is due to an insufficient user authentication mechanism in the REST API. An attacker could exploit this by sending a request to the REST API. A successful exploit could allow the attacker to gain root privileges on the underlying operating system. The vulnerable component is the REST API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Weakness Enumeration

CWE-648

Related Identifiers

BDU:2026-02318

CVE-2026-20126

Affected Products

Cisco Catalyst Sd-Wan Manager

References · 10

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20126 · Security Note
• https://bdu.fstec.ru/vul/2026-02318 · Security Note
• https://osv.dev/vulnerability/CVE-2026-20126 · Vendor Advisory
• https://twitter.com/CveTodo/status/2026716056874594467 · Twitter Post
• https://twitter.com/Felix1325456/status/2029622431921623279 · Twitter Post
• https://twitter.com/TheHackerWire/status/2026717421797781536 · Twitter Post
• https://t.me/cveNotify/154206 · Telegram Post
• https://twitter.com/Felix1325456/status/2029622540004659446 · Twitter Post
• https://twitter.com/CVEnew/status/2027744271181160492 · Twitter Post