Cisco · Catalyst SD-WAN Manager
CVE-2026-20128
Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
Cos'è
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system.
This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges.
Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.
CISA: Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.
Cosa fare
Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Scadenza per le agenzie federali USA: 23 aprile 2026
Altre falle sfruttate di Cisco
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 30 set 2026 | Hex Encoding | Catalyst SD-WAN Manager | Critica 9,8 | 39% |
| 15 giu 2026 | Directory or Path Traversal | Catalyst SD-WAN Manager | Media 6,5 | 29% |
| 9 giu 2026 | Improper Encoding or Escaping of Output | Catalyst SD-WAN Manager | Alta 7,8 | 25% |
| 20 apr 2026 | Exposure of Sensitive Information to an Unauthorized Actor | Catalyst SD-WAN Manager | Media 6,5 | 31% |
| 14 ott 2026 | Relative Path Traversal | Secure Email Gateway | Critica 9,8 | 2,2% |
| 16 set 2026 | Incorrect Use of Privileged APIs | Identity Services Engine | Critica 10,0 | 76% |
| 14 set 2026 | SQL Injection | Secure Email Gateway | Critica 9,8 | 30% |
| 9 set 2026 | Firewall Management Center Authentication Bypass Using an Alternate Path or Channel | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Critica 10,0 | 88% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.