CVE Exploit Alert: CVE-2026-20128 | HIGH | CVSS 7.5 | Cisco Catalyst SD-WAN Manager

HIGH

Alert Date: 2026-05-02

Severity Overview

Summary

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system.

This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges.
Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.

What the Attack Looks Like

If successfully exploited: A successful exploit gives the attacker a foothold on the target system with access to sensitive data and the ability to deploy secondary payloads. Because this vulnerability has a scope change, the impact extends beyond the vulnerable component — adjacent services or system resources may be compromised as well. Full confidentiality and integrity impact means an attacker can both read and modify sensitive data — useful for credential harvesting, data theft, or manipulating application state. High availability impact means the vulnerability can also cause a denial of service, which may be used for disruption or as a diversion during a broader attack.

Analyst Takeaway

The attack is launched by an attacker with local access to the target system and high-privileged (administrative) credentials are required — the attacker must already control an admin account. Exploitation requires specific conditions to be met (high attack complexity), which may reduce reliability in opportunistic campaigns. A successful exploit can break out of the vulnerable component and affect other system resources (scope change), potentially enabling broader compromise. This vulnerability is already in CISA KEV, which means exploitation has been confirmed in the wild — treat this as active risk, not theoretical exposure. Cisco Catalyst SD-WAN Manager is associated with technology that is commonly deployed in enterprise environments, so defenders should assume a higher probability of broad target interest and prioritize validation across the environment. The ATT&CK mapping suggests public-facing exploitation risk, so external exposure validation should be part of immediate triage. In parallel with patching, defenders should review external exposure, hunt for signs of exploitation, and validate whether compensating controls are in place for vulnerable assets.

MITRE ATT&CK Mapping

• T1203 – Exploitation for Client Execution
  Rationale: The vulnerability appears tied to a client application such as a browser, document handler, or end-user productivity software.
• T1190 – Exploit Public-Facing Application
  Rationale: The product appears likely to be internet-facing or commonly exposed in enterprise environments.

Detection Guidance

• T1203 — Exploitation for Client Execution
  • Inspect endpoint telemetry for suspicious execution chains: scripting engines or download utilities launched as children of browsers, Office applications, PDF readers, or other client-side software.
  • Look for LOLBin usage (certutil, mshta, rundll32, regsvr32, wmic) with suspicious arguments spawned from document-handling parent processes.
  • Review email attachment and file download activity correlated with any suspicious process execution on the same endpoint within the same time window.
• T1190 — Exploit Public-Facing Application
  • Inspect web server, reverse proxy, load balancer, and WAF logs for abnormal request patterns — unusual URIs, oversized payloads, HTTP verb abuse, or encoding anomalies.
  • Monitor for spikes in HTTP 4xx/5xx responses that may indicate probing or failed exploitation attempts preceding a successful hit.
  • Review outbound connections from affected servers for unexpected command-and-control callbacks or secondary payload retrieval to external IPs.
  • Validate which internet-facing assets are running the vulnerable version and verify whether compensating controls (WAF rules, network ACLs) are in place and effective.

Hunting Considerations

These are proactive hunts mapped to the ATT&CK techniques identified for this CVE. Run them now — do not wait for an alert to fire.

• T1203 — Exploitation for Client Execution
  • Parent-child process chains: Search for scripting engines (PowerShell, cmd.exe, wscript.exe, cscript.exe, mshta.exe) or download utilities (certutil, bitsadmin, curl) spawned as direct children of Office applications, browsers, or PDF readers. These chains are rarely legitimate.
  • LOLBin execution: Hunt for Living-off-the-Land Binaries — regsvr32, rundll32, mshta, certutil, wmic, odbcconf — executing from unusual working directories or with command lines containing encoded strings, remote paths, or -enc / -nop / IEX patterns.
  • Network connections from client apps: Flag outbound connections to new external IPs from browser, Office, or document-handling processes that do not match known CDN or update infrastructure. These indicate the exploited process reaching out for a secondary payload.
  • Windows Event IDs: Event 4688 (process creation with full command line) and Sysmon Event 1 are your primary sources. Filter for suspicious parent-child pairs. Sysmon Event 3 (network connection) from document handlers is a high-fidelity indicator.
  • Correlation with delivery: Check email gateway and proxy logs for attachment opens or file downloads on the same host in the 30 minutes before any suspicious process execution — this helps confirm the initial delivery vector.
• T1190 — Exploit Public-Facing Application
  • Web/app server logs: Search for unusual HTTP methods, requests to non-standard paths, oversized payloads, or encoding anomalies (URL-encoded or double-encoded sequences) targeting the vulnerable application. Cluster by source IP and look for low-volume probing patterns before any successful hit.
  • Process telemetry: Hunt for child processes spawned by the web server or application process (e.g., apache2, nginx, w3wp.exe, java). Web server processes should not be launching shells, scripting engines (PowerShell, bash, python), or download utilities.
  • Outbound connections from the server: Alert on unexpected outbound HTTP/S or DNS from the application server to external IPs not in your CDN or update allowlist — this is a common secondary payload retrieval indicator post-exploitation.
  • File system writes: Look for new files written to web root directories, temp folders, or cron directories by the application process — especially scripts or executables placed there after an unusual inbound request.
  • Internal pivot follow-on: After gaining a foothold, attackers move laterally. Search for new internal connections originating from the compromised server in the hour following any suspicious external request.

Recommended Actions

Immediate (0–24 Hours)

• Inventory: Identify all systems running Cisco Catalyst SD-WAN Manager. Include production, staging, dev, and cloud environments — untracked instances are the most likely to remain unpatched.
• Review local access scope: This vulnerability requires local access — assess which users or processes have local access to affected systems and whether that access could be reached from a compromised adjacent host.

Remediation

• Apply the vendor patch: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
• CISA directive deadline: 2026-04-23 — this is the mandatory deadline for US federal civilian agencies under BOD 22-01. All organizations should treat this date as a strong target regardless of federal mandate.
• Verify remediation: After patching, confirm the correct version is installed on all affected hosts. Run a vulnerability scan or use your asset management tooling to verify — do not rely solely on change tickets.
• Post-patch review: After patching, review web server and application logs for signs of exploitation prior to remediation. A successful exploit may have left behind a web shell, new account, or scheduled task.

Detection Coverage

• Verify ATT&CK coverage: Confirm your SIEM and EDR have detection logic in place for T1203, T1190. Review the Detection Guidance and Hunting Considerations sections of this alert for the specific log sources and behavioral patterns to monitor.
• Threat intelligence feeds: Monitor your TI feeds and vendor advisory channels for published indicators of compromise (IOCs), proof-of-concept exploit releases, or active campaign reporting associated with this CVE — these should trigger an immediate hunt even if no internal alerts have fired.

Vulnerability Details

Additional Notes

CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ; https://nvd.nist.gov/vuln/detail/CVE-2026-20128