EUVD-2026-30326
GHSA-m7f8-vg5v-4m9m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain read-only SD-WAN Manager credentials
-
DeliveryAuthenticate to web UI via HTTPS
-
ExploitRetrieve device configs or templates
-
ExecutionExtract plaintext credentials from responses
-
PersistRe-authenticate with extracted tokens as administrator
-
ImpactModify SD-WAN policies or routes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Logging volume control
|
| Exploitation Conditions | The attacker must possess valid, pre-existing credentials with read-only role permissions on the Cisco Catalyst SD-WAN Manager web UI. The vulnerability is triggered when the authenticated read-only user accesses device configuration endpoints, configuration templates, or device detail pages through the web interface-features that are typically available to read-only roles by design. Exploitation is limited by the requirement for prior authentication (PR:L in CVSS vector); unauthenticated remote access alone cannot trigger the vulnerability. Additionally, the sensitive information must be present and readable within the configuration or template data; if administrative processes have already sanitized or encrypted credentials in templates, the vulnerability is mitigated at the operational level (though the code flaw remains). No special configuration, non-default settings, or advanced user interaction is required-standard read-only role access to standard UI pages is sufficient. |
| Impact | This vulnerability presents moderate but legitimate real-world risk, though the CVSS 5.4 score understates the practical impact due to its reliance on two limiting factors: authenticated access and read-only role requirement. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) confirms network-based exploitation with low complexity but mandatory prior authentication. The absence of public exploit code or confirmed active exploitation (no KEV status provided, POC status unknown) suggests this is not yet a widespread operational threat. However, the attack chain is straightforward for an insider or former employee with valid credentials: information disclosure leads directly to privilege escalation without additional complexity or user interaction. Organizations using role-based access control (RBAC) to grant contractors or junior staff read-only SD-WAN visibility face elevated risk, as those individuals can extract high-privileged secrets. The true impact is not limited to CVSS's 'L' (Low) for Confidentiality and Integrity; a successful escalation grants administrative control over an entire SD-WAN network, which typically controls critical WAN traffic across multiple branch offices. SSVC assessment: Exploitation requires prior authentication (Controlled), the attack vector is network-based and low-complexity (Likely), and technical impact is high (Administrative Control)-this should be prioritized for patching in environments where RBAC segregation is important. |
| Exploit ScenarioDerived | An external contractor is granted read-only access to Cisco Catalyst SD-WAN Manager to monitor branch-office connectivity status. The contractor uses the web UI to retrieve device configurations or templates, discovering embedded API tokens and management credentials stored in plaintext or insufficiently redacted fields. The contractor then uses these extracted credentials to re-authenticate to the SD-WAN Manager with elevated privileges, modifying routing policies, adding rogue sites to the SD-WAN overlay, or disabling security policies across the enterprise branch network. No additional exploits or social engineering are required beyond this single vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 14, 2026
Cisco Catalyst SD-WAN Manager web UI fails to properly redact sensitive information in device configurations and templates, allowing authenticated users with read-only permissions to extract and leverage privileged credentials to escalate their access and modify system configurations. The vulnerability affects all versions of the product and requires only network access and valid (albeit minimal) read-only credentials; successful exploitation grants attackers high-privileged administrative capability over the SD-WAN fabric.
RemediationAI
Apply the vendor-released patch from Cisco as documented in the advisory https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R (note: exact patched versions not provided in available data - consult advisory for your release train). Pending patch deployment, implement compensating controls: (1) Restrict read-only role assignment to trusted internal personnel only; revoke read-only access for contractors, temporary staff, or third-party integrations not requiring configuration visibility-this eliminates the attacker prerequisite of valid credentials. (2) Enable and audit web UI activity logging for all configuration and template retrieval operations; escalate any read-only user accessing device templates or configurations containing sensitive fields. (3) Implement network-level access controls to limit SD-WAN Manager web UI access (typically HTTPS port 443) to a jumphost or management network, reducing the pool of authenticated users who can reach the vulnerable interface. (4) Rotate all API tokens, device credentials, and pre-shared secrets stored in device configurations and templates immediately after patching, as these are readable by current read-only users. The first control (credential restriction) is most effective but may impact legitimate use cases; audit and adjust RBAC before enforcement.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Catalyst SD-WAN Manager is a centralized management platform for SD-WAN deployments. The vulnerability stems from CWE-779 (Improper Log Redaction of Sensitive Information), where sensitive data such as API tokens, passwords, or pre-authentication credentials embedded in device configuration templates are not properly masked or removed before being presented to low-privileged users via the web UI. An attacker with read-only role access can extract these credentials from configuration or template endpoints, then use them to assume a higher-privileged context. The CPE cpe:2.3:a:cisco:cisco_catalyst_sd-wan_manager:*:*:*:*:*:*:*:* indicates the vulnerability affects all versions of the product line.
Know when Cisco Catalyst Sd Wan Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker with read-only permissions to modify configurations and perform unauthorized actions on an affected system.
This vulnerability exists because of a failure to redact sensitive information within device configurations and templates. An attacker could exploit this vulnerability by elevating their read-only permissions to those of a high-privileged user. A successful exploit could allow the attacker to access or modify configuration settings within Cisco Catalyst SD-WAN Manager as a high-privileged user.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote unauthenticated attackers can bypass peering authentication in Cisco Catalyst SD-WAN Controller (vSmart) and SD-W
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a re
Local privilege escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated netadmin u
Arbitrary file write via path traversal in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticat
Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller st
Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a
Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to
Cleartext storage of sensitive information in Cisco Catalyst SD-WAN Controller and Manager exposes credentials or other
Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files
Remote availability disruption in Cisco Catalyst SD-WAN Manager and Controller allows a low-privileged authenticated att
Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated
Cisco Catalyst SD-WAN Manager's web interface contains a reflected cross-site scripting (XSS) vulnerability that require
Exploit-DB