EUVD-2026-30325
GHSA-558q-cqp2-mrc3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess SD-WAN Manager web UI
-
DeliverySubmit crafted XML with XXE payload
-
ExploitParser resolves external entity reference
-
ExecutionExtract arbitrary file contents
-
ImpactExfiltrate sensitive configuration data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires network access to the Cisco Catalyst SD-WAN Manager web UI (typically TCP port 443/8443). No authentication, user interaction, or special configuration is required - the vulnerability affects default installations. The attack succeeds against any SD-WAN Manager instance that exposes its web interface to the attacker's network position, whether internet-facing or accessible from compromised internal networks. The Changed scope (S:C) in CVSS indicates the vulnerability allows access to resources beyond the web UI component itself, meaning successful exploitation grants read access to the underlying operating system filesystem where the SD-WAN Manager application runs. Organizations that have restricted web UI access to dedicated management VLANs or VPN-only access significantly reduce the practical attack surface, but the vulnerability remains exploitable by any attacker who can reach the management interface. |
| Impact | This vulnerability presents significant real-world risk despite no confirmed active exploitation. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) indicates the worst-case scenario: network-accessible, low complexity, requiring no authentication or user interaction, with scope change allowing access beyond the vulnerable component. The 8.6 score accurately reflects impact given the confidentiality breach potential (C:H) against a network management platform. However, risk depends heavily on deployment architecture - internet-exposed SD-WAN Manager instances face immediate exploitation risk, while internal-only deployments require prior network access. The XXE vulnerability class is well-understood with abundant tooling, making exploitation straightforward for attackers with network access. Without EPSS score or KEV status, we cannot confirm active exploitation, but Cisco's public advisory indicates coordinated disclosure rather than in-the-wild discovery. Priority should be HIGH for externally accessible instances and MEDIUM for internal deployments with strict network segmentation. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies an internet-exposed Cisco SD-WAN Manager instance through network reconnaissance. The attacker crafts an HTTP POST request to the web UI containing malicious XML with external entity declarations pointing to sensitive files like /etc/passwd, application configuration files, or SD-WAN database credentials. The vulnerable XML parser processes the external entity reference and returns the file contents in the application response, allowing the attacker to exfiltrate configuration data, cryptographic keys, or credentials for lateral movement into the SD-WAN fabric. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 14, 2026
Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files via XML External Entity (XXE) injection in the web UI. The vulnerability affects the management interface with network-accessible attack vector, low complexity, and no required privileges (CVSS 8.6). Attackers can extract sensitive configuration files, credentials, and operational data from the SD-WAN management platform. EPSS data not provided; exploitation status unknown but the unauthenticated remote vector and publicly disclosed Cisco advisory elevate real-world risk for internet-exposed instances.
RemediationAI
Upgrade Cisco Catalyst SD-WAN Manager to the fixed software version specified in Cisco Security Advisory cisco-sa-sdwan-mltvnps2-JxpWm7R available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R. Cisco typically provides fixed releases across multiple maintenance tracks; select the appropriate version for your deployment. If immediate patching is not feasible, implement network-level access controls to restrict SD-WAN Manager web UI access to trusted management networks only - block all internet-facing access and require VPN or jump host authentication. Configure web application firewall (WAF) rules to inspect and block XML requests containing DOCTYPE declarations, ENTITY definitions, or SYSTEM/PUBLIC keywords, though this may interfere with legitimate XML functionality. Monitor access logs for unusual XML POST requests to the web UI, particularly from unexpected source IPs. Note that access restrictions reduce attack surface but do not eliminate the vulnerability for authenticated internal users or attackers with network access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is an XML External Entity (XXE) injection vulnerability (CWE-20: Improper Input Validation) in Cisco Catalyst SD-WAN Manager's web UI XML parser. XXE attacks exploit misconfigured XML parsers that process external entity references, allowing attackers to include content from local files or network resources. The SD-WAN Manager web interface accepts XML input without properly sanitizing or disabling external entity processing. When a crafted XML document containing malicious entity declarations is submitted, the parser resolves these references and returns file contents in the response. The Catalyst SD-WAN Manager (formerly vManage) serves as the centralized management and orchestration platform for Cisco's SD-WAN fabric, making it a high-value target containing network topology data, device credentials, VPN configurations, and policy definitions.
Know when Cisco Catalyst Sd Wan Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in an affected system. The attacker does not need to have valid user credentials.
This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to read arbitrary files that are stored in the affected system.
Executive ViewAI
Cisco Catalyst SD-WAN Manager contains a critical XXE injection vulnerability enabling unauthenticated remote attackers to read arbitrary files from the management interface, potentially exposing credentials, configurations, and operational data. Organizations with internet-exposed SD-WAN management platforms face immediate risk of lateral movement into core network infrastructure if sensitive data is disclosed.
No vendor-released patch identified at time of analysis. Implement network segmentation to restrict SD-WAN Manager web UI access to dedicated administrative networks only; disable or isolate XML parsing features in the management interface if configuration options exist; monitor ingress traffic to the management port for suspicious XXE payloads; enforce multi-factor authentication on all SD-WAN management accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.
Remote unauthenticated attackers can bypass peering authentication in Cisco Catalyst SD-WAN Controller (vSmart) and SD-W
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a re
Local privilege escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated netadmin u
Arbitrary file write via path traversal in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticat
Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller st
Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a
Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to
Cleartext storage of sensitive information in Cisco Catalyst SD-WAN Controller and Manager exposes credentials or other
Remote availability disruption in Cisco Catalyst SD-WAN Manager and Controller allows a low-privileged authenticated att
Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated
Cisco Catalyst SD-WAN Manager's web interface contains a reflected cross-site scripting (XSS) vulnerability that require
Cisco Catalyst SD-WAN Manager web UI fails to properly redact sensitive information in device configurations and templat
Exploit-DB