Cisco Catalyst SD-WAN Manager Vulnerabilities

criticalCVE-2026-20209 CVE-2026-20210 CVE-2026-20224

Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow a remote attacker to gain access to sensitive information, elevate privileges, or gain unauthorized access to the application. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R Security Impact Rating: Critical CVE: CVE-2026-20209,CVE-2026-20210,CVE-2026-20224

CSIRTS triage

vendor: Cisco product: Catalyst SD-WAN Manager Information disclosure Privilege escalationOther

What: Multiple vulnerabilities could allow a remote attacker to gain access to sensitive information or elevate privileges.
Who is affected: Users of Cisco Catalyst SD-WAN Manager.
Urgency: Remediation is critical urgency as these vulnerabilities could lead to unauthorized access.
Action: Cisco strongly recommends upgrading to the fixed software indicated in the advisory.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Catalyst SD-WAN Manager

Get an email when a new Catalyst SD-WAN Manager advisory drops — max one per day, one-click unsubscribe.

Details

Source: Cisco Security Advisories (INTL · vendor-psirt · site)
Severity: critical
Published: 2026-05-14
Exploitation: Not in CISA KEV at last sync

Original advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Catalyst%20SD-WAN%20Manager%20Vulnerabilities%26vs_k=1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-202090.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all scored CVEs.
Low exploitation riskCVE-2026-202100.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all scored CVEs.
Low exploitation riskCVE-2026-202240.70% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-20209	coverage & exploitation status	NVD · CVE.org
CVE-2026-20210	coverage & exploitation status	NVD · CVE.org
CVE-2026-20224	coverage & exploitation status	NVD · CVE.org

Recent advisories for Cisco Catalyst SD-WAN

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

criticalexploitedCisco Catalyst SD-WAN Controller Authentication Bypass Vulnerabilitycisco-psirt · 2026-06-16
highexploitedCisco Catalyst SD-WAN Controller Authentication Bypass Vulnerabilitycisco-psirt · 2026-06-16
unknownNCSC-2026-0199 [1.00] [M/H] Vulnerability fixed in Cisco Catalyst SD-WAN Managerncsc-nl · 2026-06-16
mediumexploitedCisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerabilitycisco-psirt · 2026-06-15
criticalexploitedCVE-2026-20262: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerabilitycisa-kev · 2026-06-15
unknownexploitedCisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privile…cisco-psirt · 2026-06-12