Vulnerability record · CVE-2026-20128 · published 25 February 2026
CVE-2026-20128: Cisco Catalyst SD-WAN Manager DCA credential file exposure
Cisco · Catalyst Sd Wan Manager
Cisco Catalyst SD-WAN Manager stores the Data Collection Agent (DCA) user password in a recoverable credential file on the affected system. An unauthenticated remote attacker can send a crafted HTTP request to read that file and obtain the DCA password. The flaw affects releases before 20.18, which are not affected per Cisco's note.
Description
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Automated analysis
critical priorityThe flaw allows unauthenticated remote credential theft leading to privileged access, and it is in CISA KEV with a near-term remediation deadline.
What it is
Cisco Catalyst SD-WAN Manager stores the Data Collection Agent (DCA) user password in a recoverable credential file on the affected system. An unauthenticated remote attacker can send a crafted HTTP request to read that file and obtain the DCA password. The flaw affects releases before 20.18, which are not affected per Cisco's note.
Impact
An attacker gains DCA user privileges on the affected system and can use the recovered credentials to access another affected system with the same privileges.
Attack surface
Reached over the network via a crafted HTTP request to the SD-WAN Manager; the description states no authentication is required and no user interaction is needed. The CVSS vector (AV:L/AC:H/PR:H) conflicts with the unauthenticated remote description, so treat the vector as inconsistent with the advisory text.
Exploitation
Cisco Catalyst SD-WAN Manager is listed in CISA KEV with a 2026-04-23 remediation due date, indicating known exploitation. EPSS 30-day probability is 0.06943 (93.8th percentile), and the only reference tags are Vendor Advisory and US Government Resource.
What to do
- Upgrade Cisco Catalyst SD-WAN Manager to release 20.18 or later, which Cisco states is not affected.
- If immediate upgrade is not possible, follow CISA Emergency Directive 26-03 and the CISA Hunt & Hardening Guidance for Cisco SD-WAN devices.
- Restrict management-plane HTTP access to trusted networks and block untrusted sources from reaching the SD-WAN Manager interface.
- Rotate DCA user credentials and any credentials stored on affected systems, since the password file may have been read.
- Apply BOD 22-01 guidance for cloud services or discontinue use if mitigations are unavailable.
Detection
- Search SD-WAN Manager HTTP logs for crafted or anomalous requests targeting DCA-related paths or credential files.
- Monitor for unexpected DCA user logins and for DCA account activity originating from unfamiliar source addresses.
- Audit affected systems for the presence of the DCA credential file and verify its permissions and exposure.
- Correlate DCA authentication events across SD-WAN Manager instances for signs of lateral movement using recovered credentials.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-20128 to the Known Exploited Vulnerabilities catalog on 20 April 2026 as "Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability". Required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal deadline 23 April 2026.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128 | US Government Resource |
Track CVE-2026-20128 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-20128), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
