{"id":"cisco-sdwan-manager-information-theft-apr-2026","category":"patch","status":"closed","title":"Cisco Catalyst SD-WAN Manager information-theft flaws CVE-2026-20128 and CVE-2026-20133 exploited","tldr":"Two exploited Cisco Catalyst SD-WAN Manager flaws expose private information and a service password without a login. Businesses should have their network provider install Cisco’s fixed releases and arrange a compromise assessment.","summary":"Two flaws in Cisco Catalyst SD-WAN Manager, formerly vManage, expose private system information and a Data Collection Agent password to remote attackers without a login. These affect organisations running the network-management software. Cisco disclosed them in February and completed supported-branch fixes that month. CISA listed both as exploited on 20 April. In May, Cisco Talos reported widespread attacks combining them with the separately recorded file-overwrite flaw CVE-2026-20122, installing backdoors, cryptocurrency miners and credential-stealing malware. Cisco’s revised description of CVE-2026-20128 supersedes the older authenticated-local description supplied with this incident. As at 3 November, fixes remain available; the reviewed sources provide no subsequent all-clear for compromised systems. Cisco directs customers to its support team for assessment and remediation.","action":"Nothing to update on ordinary family phones or computers: this is business network-management software. If your business or family office uses it, ask the network provider to open a Cisco TAC case, arrange a compromise assessment and install the appropriate fixed release listed below.","product":"Cisco Catalyst SD-WAN Manager (formerly vManage)","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-20128","CVE-2026-20133"],"tags":["cisco","sd-wan","network-management","information-disclosure","credential-theft","actively-exploited"],"affected":["Both CVEs: releases earlier than 20.9; migrate to a fixed release.","Both CVEs: 20.9 before 20.9.8.2.","Both CVEs: 20.10 and 20.11; migrate to a fixed release.","Both CVEs: affected 20.12 releases before 20.12.5.3 or 20.12.6.1, as appropriate.","Both CVEs: 20.13 and 20.14; migrate to a fixed release.","Both CVEs: 20.15 before 20.15.4.2.","Both CVEs: 20.16; migrate to a fixed release.","CVE-2026-20133 only: 20.18 before 20.18.2.1. Cisco says 20.18 and later are unaffected by CVE-2026-20128."],"fixed":["20.9.8.2","20.12.5.3","20.12.6.1","20.15.4.2","20.18.2.1 (CVE-2026-20133; this branch is unaffected by CVE-2026-20128)","20.15.405 (Cisco-hosted cluster deployments only)"],"matches":[],"sources":[{"kind":"advisory","title":"Cisco Catalyst SD-WAN Vulnerabilities","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v","by":"Cisco","date":"2026-04-22"},{"kind":"advisory","title":"Remediate Catalyst SD-WAN Security Advisory - February 2026","url":"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/225525-internal-remediate-catalyst-sd-wan.html","by":"Cisco","date":"2026-03-19"},{"kind":"research","title":"Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities","url":"https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/","by":"Cisco Talos","date":"2026-05-14"},{"kind":"advisory","title":"Cisco security advisory (AV26-166) – Update 3","url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-166","by":"Canadian Centre for Cyber Security","date":"2026-04-20"},{"kind":"news","title":"CISA confirms exploitation of 3 more Cisco networking device vulnerabilities","url":"https://www.cybersecuritydive.com/news/cisa-cisco-vulnerabilities-sd-wan-confirm-exploitation/818064/","by":"Cybersecurity Dive","date":"2026-04-21"}],"started":"2026-04-20","closed":"2026-05-14","created":"2026-11-03T22:25:43.997Z","updated":"2026-11-03T22:25:43.997Z","cve_notes":[{"cve":"CVE-2026-20128","name":"DCA password exposure in Cisco SD-WAN Manager","what":"An exposed Data Collection Agent credential file lets remote attackers without a login obtain its password and gain DCA access to another affected system.","severity":"high","cvss":7.5},{"cve":"CVE-2026-20133","name":"Private file exposure in Cisco SD-WAN Manager","what":"Inadequate file-access restrictions let remote attackers without a login read sensitive operating-system information through SD-WAN Manager’s API.","severity":"high","cvss":7.5}],"timeline":[{"at":"2026-05-14","added":"2026-11-03T22:23:31.291Z","kind":"wider-attacks","text":"Cisco Talos reported widespread attacks combining both flaws with CVE-2026-20122 during March and April. Ten activity clusters installed backdoors, cryptocurrency miners or credential-stealing malware.","url":"https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/","by":"Cisco Talos","patch":null},{"at":"2026-04-22","added":"2026-11-03T22:23:31.291Z","kind":"vendor-revised","text":"Cisco confirmed active exploitation of CVE-2026-20133.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v","by":"Cisco","patch":null},{"at":"2026-04-20","added":"2026-11-03T22:23:31.291Z","kind":"cisa-added","text":"CISA added CVE-2026-20128 and CVE-2026-20133 to its Known Exploited Vulnerabilities catalogue, alongside the separately tracked CVE-2026-20122.","url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-166","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-03-18","added":"2026-11-03T22:23:31.291Z","kind":"vendor-revised","text":"Cisco revised CVE-2026-20128’s description to cover remote attacks without authentication and added compromise indicators.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v","by":"Cisco","patch":null},{"at":"2026-03-05","added":"2026-11-03T22:23:31.291Z","kind":"wider-attacks","text":"Cisco confirmed active exploitation of CVE-2026-20128.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v","by":"Cisco","patch":null},{"at":"2026-02-27","added":"2026-11-03T22:23:31.291Z","kind":"new-fix","text":"Cisco confirmed that 20.9.8.2 was available, completing the fixes for supported affected branches.","url":"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/225525-internal-remediate-catalyst-sd-wan.html","by":"Cisco","patch":"patched"},{"at":"2026-02-25","added":"2026-11-03T22:23:31.291Z","kind":"disclosed","text":"Cisco published its SD-WAN remediation guidance. Fixes were available for several branches, but the 20.9 update was still pending.","url":"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/225525-internal-remediate-catalyst-sd-wan.html","by":"Cisco","patch":"partial"}],"url":"https://hard.fyi/live/cisco-sdwan-manager-information-theft-apr-2026/","json":"https://hard.fyi/api/live?id=cisco-sdwan-manager-information-theft-apr-2026"}