← Back to browse · API

CVE-2026-20128

Severity
HIGH
CVSS
7.5
EPSS
0.06943
Risk score
57.43
CISA KEV
Yes
PoC
No
Published
2026-04-20
Modified
2026-04-20
First seen
2026-08-07
Aliases
EUVD-2026-8676, GHSA-MP6J-7G85-8PG2
Products
Cisco:Catalyst SD-WAN Manager, Cisco:Cisco Catalyst SD-WAN Manager 17.2.10, Cisco:Cisco Catalyst SD-WAN Manager 17.2.5, Cisco:Cisco Catalyst SD-WAN Manager 17.2.6, Cisco:Cisco Catalyst SD-WAN Manager 17.2.7, Cisco:Cisco Catalyst SD-WAN Manager 17.2.8, Cisco:Cisco Catalyst SD-WAN Manager 18.3.0, Cisco:Cisco Catalyst SD-WAN Manager 18.3.3.1, Cisco:Cisco Catalyst SD-WAN Manager 18.3.4, Cisco:Cisco Catalyst SD-WAN Manager 18.3.5, Cisco:Cisco Catalyst SD-WAN Manager 18.3.6, Cisco:Cisco Catalyst SD-WAN Manager 18.3.7, Cisco:Cisco Catalyst SD-WAN Manager 18.3.8, Cisco:Cisco Catalyst SD-WAN Manager 18.4.1, Cisco:Cisco Catalyst SD-WAN Manager 18.4.303, Cisco:Cisco Catalyst SD-WAN Manager 18.4.4, Cisco:Cisco Catalyst SD-WAN Manager 19.0.0, Cisco:Cisco Catalyst SD-WAN Manager 19.2.097, Cisco:Cisco Catalyst SD-WAN Manager 19.2.099, Cisco:Cisco Catalyst SD-WAN Manager 19.2.1, Cisco:Cisco Catalyst SD-WAN Manager 19.2.3, Cisco:Cisco Catalyst SD-WAN Manager 20.1.1.1, Cisco:Cisco Catalyst SD-WAN Manager 20.1.2, Cisco:Cisco Catalyst SD-WAN Manager 20.1.3.1, Cisco:Cisco Catalyst SD-WAN Manager 20.3.2.1, Cisco:Cisco Catalyst SD-WAN Manager 20.3.3.0.16, Cisco:Cisco Catalyst SD-WAN Manager 20.3.3.0.2, Cisco:Cisco Catalyst SD-WAN Manager 20.3.3.0.4, Cisco:Cisco Catalyst SD-WAN Manager 20.3.3.1.5, Cisco:Cisco Catalyst SD-WAN Manager 20.3.4.0.11, Cisco:Cisco Catalyst SD-WAN Manager 20.3.4.0.19, Cisco:Cisco Catalyst SD-WAN Manager 20.3.4.0.20, Cisco:Cisco Catalyst SD-WAN Manager 20.3.4.0.24, Cisco:Cisco Catalyst SD-WAN Manager 20.3.4.1, Cisco:Cisco Catalyst SD-WAN Manager 20.3.4.2.2, Cisco:Cisco Catalyst SD-WAN Manager 20.3.4.3, Cisco:Cisco Catalyst SD-WAN Manager 20.3.5.1, Cisco:Cisco Catalyst SD-WAN Manager 20.3.6, Cisco:Cisco Catalyst SD-WAN Manager 20.3.8, Cisco:Cisco Catalyst SD-WAN Manager 20.4.1.0.1, Cisco:Cisco Catalyst SD-WAN Manager 20.4.2.2.1, Cisco:Cisco Catalyst SD-WAN Manager 20.4.2.2.4, Cisco:Cisco Catalyst SD-WAN Manager 20.4.2.3, Cisco:Cisco Catalyst SD-WAN Manager 20.5.1, Cisco:Cisco Catalyst SD-WAN Manager 20.5.1.0.2, Cisco:Cisco Catalyst SD-WAN Manager 20.5.1.2, Cisco:Cisco Catalyst SD-WAN Manager 20.6.1.1, Cisco:Cisco Catalyst SD-WAN Manager 20.6.2.2, Cisco:Cisco Catalyst SD-WAN Manager 20.6.2.2.4, Cisco:Cisco Catalyst SD-WAN Manager 20.7.1EFT2, Cisco:Cisco Catalyst SD-WAN Manager 20.9.1EFT2
Sources
euvd EUVD-2026-8676
cisa.gov CVE-2026-20128

Description

Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.

References