Cisco Catalyst SD-WAN Manager information-theft flaws CVE-2026-20128 and CVE-2026-20133 exploited
Two exploited Cisco Catalyst SD-WAN Manager flaws expose private information and a service password without a login. Businesses should have their network provider install Cisco’s fixed releases and arrange a compromise assessment.
Nothing to update on ordinary family phones or computers: this is business network-management software. If your business or family office uses it, ask the network provider to open a Cisco TAC case, arrange a compromise assessment and install the appropriate fixed release listed below.
What’s happening
Two flaws in Cisco Catalyst SD-WAN Manager, formerly vManage, expose private system information and a Data Collection Agent password to remote attackers without a login. These affect organisations running the network-management software. Cisco disclosed them in February and completed supported-branch fixes that month. CISA listed both as exploited on 20 April. In May, Cisco Talos reported widespread attacks combining them with the separately recorded file-overwrite flaw CVE-2026-20122, installing backdoors, cryptocurrency miners and credential-stealing malware. Cisco’s revised description of CVE-2026-20128 supersedes the older authenticated-local description supplied with this incident. As at 3 November, fixes remain available; the reviewed sources provide no subsequent all-clear for compromised systems. Cisco directs customers to its support team for assessment and remediation.
- What
- Flaw
- Affects
- Cisco Catalyst SD-WAN Manager (formerly vManage)
- Affected
- Both CVEs: releases earlier than 20.9; migrate to a fixed release.
Both CVEs: 20.9 before 20.9.8.2.
Both CVEs: 20.10 and 20.11; migrate to a fixed release.
Both CVEs: affected 20.12 releases before 20.12.5.3 or 20.12.6.1, as appropriate.
Both CVEs: 20.13 and 20.14; migrate to a fixed release.
Both CVEs: 20.15 before 20.15.4.2.
Both CVEs: 20.16; migrate to a fixed release.
CVE-2026-20133 only: 20.18 before 20.18.2.1. Cisco says 20.18 and later are unaffected by CVE-2026-20128. - Fixed in
- 20.9.8.2
20.12.5.3
20.12.6.1
20.15.4.2
20.18.2.1 (CVE-2026-20133; this branch is unaffected by CVE-2026-20128)
20.15.405 (Cisco-hosted cluster deployments only) - Since
- 20 Apr 2026
- Closed
- 14 May 2026
Timeline
- Wider attacks
Cisco Talos reported widespread attacks combining both flaws with CVE-2026-20122 during March and April. Ten activity clusters installed backdoors, cryptocurrency miners or credential-stealing malware.
- Vendor revised
Cisco confirmed active exploitation of CVE-2026-20133.
- CISA added
CISA added CVE-2026-20128 and CVE-2026-20133 to its Known Exploited Vulnerabilities catalogue, alongside the separately tracked CVE-2026-20122.
- Vendor revised
Cisco revised CVE-2026-20128’s description to cover remote attacks without authentication and added compromise indicators.
- Wider attacks
Cisco confirmed active exploitation of CVE-2026-20128.
- New fixFixed
Cisco confirmed that 20.9.8.2 was available, completing the fixes for supported affected branches.
- Made publicPartly fixed
Cisco published its SD-WAN remediation guidance. Fixes were available for several branches, but the 20.9 update was still pending.
Sources
- Cisco Catalyst SD-WAN VulnerabilitiesCisco · 22 Apr 2026
- Remediate Catalyst SD-WAN Security Advisory - February 2026Cisco · 19 Mar 2026
- Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilitiesCisco Talos · 14 May 2026
- Cisco security advisory (AV26-166) – Update 3Canadian Centre for Cyber Security · 20 Apr 2026
- CISA confirms exploitation of 3 more Cisco networking device vulnerabilitiesCybersecurity Dive · 21 Apr 2026