KEVIntel
PRO Back to KEVs
7.5
CVSS
High

CVE-2026-20128

PUBLISHED

Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability

1 day faster than CISA KEV

Exploited in the wild No user interaction
Vendor
Cisco
Product
Cisco Catalyst SD-WAN Manager
Published
Feb 25, 2026
EPSS
0.1% · 23% pctl

Automate this intelligence with the Pro API

Everything on this page — CVSS, EPSS, exploit status, PoCs, scanner integrations, mentions, tags, and immediate honeypot data — is available programmatically for VM, SOC, and CTI workflows.

Learn about Pro

Description

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.

cisa edge

Weaknesses (CWE)

  • CWE-257

    Storing Passwords in a Recoverable Format

CVSS scores

CVSS v3.1 7.5 High

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitation status

Exploited in the wild

Recorded 2026-06-01 13:22:22 UTC · CVE

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CVE First 2026-06-01 13:22 UTC
CISA 2026-06-02 14:01 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel

  • KEV confirmed by CISA