CVE-2026-20128

Severity CVSS v4.0:

Pending analysis

Type:

CWE-257 Storing Passwords in a Recoverable Format

Publication date:

25/02/2026

Last modified:

21/04/2026

Description

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system.<br /> <br /> This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges.<br /> Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.

Impact

Vector 3.x

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 7.50 HIGH
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): High
User Interaction (UI): None
Scope (S): Changed
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x

7.50

Severity 3.x

HIGH

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::		20.9.8.2 (excluding)
cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::	20.10 (including)	20.12.5.3 (excluding)
cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::	20.13 (including)	20.15.4.2 (excluding)
cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::	20.16 (including)	20.18 (excluding)
cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:::::::*

To consult the complete list of CPE names with products and versions, see this page

CVE-2026-20128

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools