CVE-2026-20128

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-20128
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128 US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*
History

21 Apr 2026, 12:48

Type Values Removed Values Added
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128 - US Government Resource

20 Apr 2026, 20:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128 -

20 Mar 2026, 22:16

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad en la función de Agente de Recopilación de Datos (DCA) de Cisco Catalyst SD-WAN Manager podría permitir a un atacante local autenticado obtener privilegios de usuario de DCA en un sistema afectado. Para explotar esta vulnerabilidad, el atacante debe tener credenciales válidas de vmanage en el sistema afectado. Esta vulnerabilidad se debe a la presencia de un archivo de credenciales para el usuario de DCA en un sistema afectado. Un atacante podría explotar esta vulnerabilidad al acceder al sistema de archivos como un usuario con privilegios bajos y leer el archivo que contiene la contraseña de DCA de ese sistema afectado. Un exploit exitoso podría permitir al atacante acceder a otro sistema afectado y obtener privilegios de usuario de DCA. Nota: Las versiones 20.18 y posteriores de Cisco Catalyst SD-WAN Manager no se ven afectadas por esta vulnerabilidad.
Summary (en) A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker to gain DCA user privileges on an affected system. To exploit this vulnerability, the attacker must have valid vmanage credentials on the affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by accessing the filesystem as a low-privileged user and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability. (en) A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.

04 Mar 2026, 21:13

Type Values Removed Values Added
First Time Cisco
Cisco catalyst Sd-wan Manager
CPE cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*
References () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v - () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v - Vendor Advisory

25 Feb 2026, 17:25

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-25 17:25

Updated : 2026-04-21 12:48

NVD link : CVE-2026-20128

Mitre link : CVE-2026-20128

CVE.ORG link : CVE-2026-20128

JSON object : View

Products Affected

cisco

  • catalyst_sd-wan_manager
CWE
CWE-257

Storing Passwords in a Recoverable Format