CVE-2026-20133: Cisco Catalyst SD-WAN Manager insufficient file system restrictions expose data

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityIt is in CISA KEV with a near-term remediation deadline and a high EPSS score, so exploitation is expected or observed.

What it is

Cisco Catalyst SD-WAN Software has insufficient file system restrictions that let an attacker read sensitive files on the underlying operating system. The CVSS vector scores it as remotely reachable without authentication, while the description states exploitation requires netadmin privileges and access to the vshell. It matters because it is listed in CISA KEV with a short remediation deadline and affects SD-WAN management infrastructure.

Impact

An attacker who reaches the vshell can read sensitive information from the underlying operating system, potentially including credentials or configuration data useful for lateral movement. The flaw is confidentiality-only; no integrity or availability impact is described.

Attack surface

Reachable over the network (AV:N) with no user interaction (UI:N); the CVSS vector lists PR:N, but the description says the attacker must be authenticated with netadmin privileges and access the vshell, so the record is internally inconsistent on authentication.

Exploitation

Listed in CISA KEV with a due date of 2026-04-23, indicating known exploitation, and EPSS is 0.31353 (98th percentile). No ransomware campaign use is documented and no public exploit reference is included.

What to do

• Apply the Cisco security advisory fix for Catalyst SD-WAN Manager as the first action.
• Follow CISA Emergency Directive 26-03 and the CISA Hunt & Hardening Guidance for Cisco SD-WAN devices.
• Restrict and audit netadmin accounts and vshell access; remove unnecessary privileged accounts.
• Limit management-plane exposure of SD-WAN Manager to trusted networks and monitor for unauthorized access.
• If mitigations are unavailable, apply BOD 22-01 guidance for cloud services or discontinue use of the product.

Detection

• Hunt for unexpected vshell sessions or netadmin logins on SD-WAN Manager.
• Review file access and command logs for reads of sensitive OS files from vshell.
• Monitor network access to SD-WAN Manager management interfaces from untrusted sources.
• Correlate authentication events with post-login file system activity for signs of data collection.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.