What is the CVSS score of CVE-2026-20224?

CVE-2026-20224 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Cisco Catalyst SD-WAN Manager are affected by CVE-2026-20224?

Cisco Catalyst SD-WAN Manager contains a critical XXE injection vulnerability enabling unauthenticated remote attackers to read arbitrary files from the management interface, potentially exposing…

How to fix or mitigate CVE-2026-20224?

Within 24 hours: Identify all Cisco Catalyst SD-WAN Manager instances accessible from untrusted networks using asset inventory and network scans; document current versions and access controls. Within 7 days: Restrict network access to the SD-WAN management interface to trusted administrative networks only via firewall rules; enable authentication enforcement if available in your deployment version. Within 30 days: Monitor Cisco security advisories for patch availability and apply immediately upon release; conduct forensic review of management interface logs for evidence of unauthorized file access attempts.

Cisco Catalyst SD-WAN Manager CVE-2026-20224

EUVD-2026-30325 HIGH

Improper Input Validation (CWE-20)

2026-05-14 cisco

GHSA-558q-cqp2-mrc3

XXE Cisco Cisco Catalyst Sd Wan Manager

8.6

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from Vendor (cisco) · only source for this CVE.

CVSS VectorVendor: cisco

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 14, 2026 - 17:31 vuln.today

CVE Published

May 14, 2026 - 16:08 nvd

HIGH 8.6

DescriptionCVE.org

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in an affected system. The attacker does not need to have valid user credentials.

This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to read arbitrary files that are stored in the affected system.

AnalysisAI

Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files via XML External Entity (XXE) injection in the web UI. The vulnerability affects the management interface with network-accessible attack vector, low complexity, and no required privileges (CVSS 8.6). Attackers can extract sensitive configuration files, credentials, and operational data from the SD-WAN management platform. EPSS data not provided; exploitation status unknown but the unauthenticated remote vector and publicly disclosed Cisco advisory elevate real-world risk for internet-exposed instances.

Technical ContextAI

This is an XML External Entity (XXE) injection vulnerability (CWE-20: Improper Input Validation) in Cisco Catalyst SD-WAN Manager's web UI XML parser. XXE attacks exploit misconfigured XML parsers that process external entity references, allowing attackers to include content from local files or network resources. The SD-WAN Manager web interface accepts XML input without properly sanitizing or disabling external entity processing. When a crafted XML document containing malicious entity declarations is submitted, the parser resolves these references and returns file contents in the response. The Catalyst SD-WAN Manager (formerly vManage) serves as the centralized management and orchestration platform for Cisco's SD-WAN fabric, making it a high-value target containing network topology data, device credentials, VPN configurations, and policy definitions.

RemediationAI

Upgrade Cisco Catalyst SD-WAN Manager to the fixed software version specified in Cisco Security Advisory cisco-sa-sdwan-mltvnps2-JxpWm7R available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R. Cisco typically provides fixed releases across multiple maintenance tracks; select the appropriate version for your deployment. If immediate patching is not feasible, implement network-level access controls to restrict SD-WAN Manager web UI access to trusted management networks only - block all internet-facing access and require VPN or jump host authentication. Configure web application firewall (WAF) rules to inspect and block XML requests containing DOCTYPE declarations, ENTITY definitions, or SYSTEM/PUBLIC keywords, though this may interfere with legitimate XML functionality. Monitor access logs for unusual XML POST requests to the web UI, particularly from unexpected source IPs. Note that access restrictions reduce attack surface but do not eliminate the vulnerability for authenticated internal users or attackers with network access.