Cisco CVE-2026-20128

Requires valid vmanage administrative credentials on the target Cisco Catalyst SD-WAN Manager system (PR:H - high privileges). Attack complexity is high (AC:H), suggesting exploitation requires specific knowledge of DCA credential file locations within the SD-WAN Manager filesystem or particular system states. Local access vector (AV:L) means attacker must execute commands on the SD-WAN Manager system itself - remote network exploitation is not possible. Exploitation is limited to Catalyst SD-WAN Manager versions prior to 20.18; version 20.18 and later are explicitly not affected. No user interaction required (UI:N) once attacker has authenticated access. Limiting factors: initial compromise of high-privilege vmanage credentials creates significant barrier (typically requires separate phishing/credential attack), and local access requirement prevents remote exploitation by unauthenticated internet attackers. However, scope change (S:C) means successful exploitation on one system enables lateral movement to other SD-WAN components using harvested DCA credentials.

Risk assessment presents conflicting signals requiring careful interpretation. CVSS 7.5 (High) reflects significant impact with scope change enabling lateral movement across SD-WAN infrastructure. CISA KEV listing confirms active exploitation in real-world attacks, elevating this from theoretical to demonstrated threat. However, EPSS score of 0.02% (5th percentile) indicates exploitation remains rare and targeted rather than widespread commodity attacks. This discrepancy suggests nation-state or sophisticated threat actors targeting specific SD-WAN deployments rather than mass exploitation. High privilege requirement (PR:H - valid vmanage credentials) and high attack complexity (AC:H) create substantial barriers: attackers must first compromise administrative credentials through phishing, credential stuffing, or other initial access methods. Public POC availability lowers technical barriers for adversaries with initial access. SSVC decision priority: exploitation status is active (KEV-confirmed), technical impact is total (credential theft enables full system control), but automatability is limited by authentication requirements. Real-world priority is HIGH for organizations running affected Cisco SD-WAN deployments, especially government/critical infrastructure sectors (typical KEV targets), but MEDIUM-LOW for organizations not using Cisco SD-WAN or already on version 20.18+. The scope change makes this particularly dangerous in multi-tenant or federated SD-WAN environments where one compromised manager can cascade to others.

An attacker who previously compromised vmanage administrative credentials (via phishing, credential stuffing, or supply chain attack) authenticates to the SD-WAN Manager system. Using legitimate admin access, the attacker navigates the filesystem to locate the DCA credential file stored in a predictable location. After reading the cleartext or weakly-encoded DCA password, the attacker leverages these elevated DCA privileges to authenticate to other SD-WAN Manager instances in the environment or managed edge devices, establishing persistent access across the enterprise SD-WAN fabric for reconnaissance, data exfiltration, or operational disruption. Public exploit code availability eliminates the need for custom tooling.