CVE-2026-20122
Actively exploited. CVE-2026-20122 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-04-20) — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.
Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an attacker to access an affected system, elevate privileges to root, gain access to sensitive information, and overwrite arbitrary files. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v Security Impact Rating: Critical CVE: CVE-2026-20122,CVE-2026-20126,CVE-2026-20128,CVE-2026-20129,CVE-2026-20133
CSIRTS triage
- What
- Multiple vulnerabilities could allow an attacker to access an affected system, elevate privileges to root, gain access to sensitive information, and overwrite arbitrary files.
- Who is affected
- Deployments of Cisco Catalyst SD-WAN Manager.
- Urgency
- Remediation is urgent due to the critical severity and confirmed exploitation of these vulnerabilities.
- Action
- Customers are strongly recommended to upgrade to the fixed software indicated in the advisory.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-20122
Get an email if CVE-2026-20122 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 93% of all EPSS-scored CVEs.
Advisory coverage (2)
- criticalexploitedCisco Catalyst SD-WAN Vulnerabilitiescisco-psirt · 2026-04-22
- criticalexploitedCVE-2026-20122: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerabilitycisa-kev · 2026-04-20
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-20122)