PT-2026-21955 · Cisco · Cisco Catalyst Sd-Wan Manager

Arthur Vidineyev · Published 2026-02-25 · Updated 2026-06-04 · CVE-2026-20128

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN Manager versions prior to 20.18

Description A flaw in the Data Collection Agent (DCA) feature allows an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This issue is caused by the presence of a credential file for the DCA user. An attacker can exploit this by sending a crafted HTTP request to read the file containing the DCA password, potentially allowing access to other affected systems and privilege escalation.

Recommendations Update to version 20.18 or later.

Fix

LPE

Weakness Enumeration

CWE-257

Related Identifiers

BDU:2026-02320

CVE-2026-20128

Affected Products

Cisco Catalyst Sd-Wan Manager

References · 56

• https://nvd.nist.gov/vuln/detail/CVE-2026-20128 · Security Note
• https://osv.dev/vulnerability/CVE-2026-20128 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02320 · Security Note
• https://fidelissecurity.com/vulnerabilities/cve-2026-20128 · Reddit Post
• https://t.me/aptreports/28865 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128 · Note
• https://twitter.com/threatcluster/status/2046522024395165865 · Twitter Post
• https://t.me/true_secator/7969 · Telegram Post
• https://twitter.com/ThreatSynop/status/2029950521822359558 · Twitter Post
• https://twitter.com/Felix1325456/status/2029622598209085813 · Twitter Post
• https://twitter.com/MertSARICA/status/2029926378389319800 · Twitter Post
• https://twitter.com/secureu_in/status/2030861536491888747 · Twitter Post
• https://twitter.com/seoscottsdale/status/2031379733880123503 · Twitter Post
• https://twitter.com/seoscottsdale/status/2047307018713874802 · Twitter Post