Cisco Catalyst SD-WAN Vulnerabilities
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an attacker to access an affected system, elevate privileges to root, gain access to sensitive information, and overwrite arbitrary files. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v Security Impact Rating: Critical CVE: CVE-2026-20122,CVE-2026-20126,CVE-2026-20128,CVE-2026-20129,CVE-2026-20133
CSIRTS triage
- What
- Multiple vulnerabilities could allow an attacker to access an affected system, elevate privileges to root, gain access to sensitive information, and overwrite arbitrary files.
- Who is affected
- Deployments of Cisco Catalyst SD-WAN Manager.
- Urgency
- Remediation is urgent due to the critical severity and confirmed exploitation of these vulnerabilities.
- Action
- Customers are strongly recommended to upgrade to the fixed software indicated in the advisory.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Catalyst SD-WAN Manager
Get an email when a new Catalyst SD-WAN Manager advisory drops — max one per day, one-click unsubscribe.
Details
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-20122Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 98% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-201260.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Exploitation confirmedCVE-2026-20128Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 94% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-201290.72% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all EPSS-scored CVEs.
- Exploitation confirmedCVE-2026-20133Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 98% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-20122 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-20126 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-20128 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-20129 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-20133 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- criticalexploitedCVE-2026-20133: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulne…cisa-kev
- criticalexploitedCVE-2026-20128: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerabilitycisa-kev
- criticalexploitedCVE-2026-20122: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerabilitycisa-kev
Recent advisories for Cisco Catalyst SD-WAN
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCisco Catalyst SD-WAN Manager Information Disclosure Vulnerabilitycisco-psirt · 2026-08-07
- high[NEW] [high] Cisco Catalyst SD-WAN Manager: Multiple Vulnerabilitiescert-bund · 2026-08-06
- unknownNCSC-2026-0277 [1.00] [M/H] Vulnerabilities patched in Cisco Catalyst SD-WANncsc-nl · 2026-08-06
- highCVE-2026-20313: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Cat…nvd · 2026-08-05
- highCVE-2026-20312: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Cat…nvd · 2026-08-05
- criticalCVE-2026-20310: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Cat…nvd · 2026-08-05
More from Cisco Security Advisories
- criticalCisco Crosswork Security Hardening Release: August 20262026-08-21
- criticalCisco Advance Notification for Publication of August 19, 2026, Security Advisories2026-08-19
- mediumCisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Server-Side Request Forge…2026-08-19
- highCisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability2026-08-19
- criticalCisco Secure Workload Software Security Hardening Release: August 20262026-08-19