EUVD-2026-53472
GHSA-5gw4-ww4c-vqvv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege SD-WAN Manager/Controller credentials
-
DeliveryAuthenticate over network to management API
-
ExploitAccess cleartext sensitive data in storage or API responses
-
ExecutionExtract administrative credentials or cryptographic keys
-
PersistAuthenticate as administrator or use keys for fabric control
-
ImpactManipulate WAN policy or intercept traffic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V14 - Data Protection Encrypted storage of sensitive data
|
| Exploitation Conditions | The CVSS PR:L metric confirms exploitation requires a low-privilege authenticated account on the SD-WAN Manager or Controller - unauthenticated external exploitation is not possible directly. The AV:N vector confirms the management interface must be network-reachable, which is standard for SD-WAN Manager deployments but should be restricted to administrative networks. The specific storage location (database field, configuration file, log output, or API response) where sensitive data is exposed in cleartext is not detailed in the available description - defenders should consult the Cisco advisory for specifics. What limits exploitation: the PR:L barrier means an attacker must first compromise or possess a valid (even read-only) SD-WAN account; mass unauthenticated Internet exploitation is not possible. AC:L indicates no special race conditions or timing requirements once authenticated. The vulnerability does not require any specific non-default configuration mode - it is a baseline storage behavior across the affected version range. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8, indicating low-complexity network exploitation requiring only low-privilege authentication - a meaningful but not negligible barrier. The C:H impact is expected for CWE-312; however, the vendor-assigned I:H and A:H likely reflect the downstream consequence of credential reuse rather than direct storage manipulation, which slightly overstates the immediate technical impact. No KEV listing and no public POC reduce real-world urgency compared to an externally discovered vulnerability. The internal discovery by Cisco's engineering team strongly suggests this was not a zero-day exploited before disclosure. EPSS data is not available in the provided input and therefore cannot be cited. The primary real-world risk is insider threat or compromised low-privilege accounts leveraging cleartext secrets to escalate to full SD-WAN administrative control - a high-impact scenario for organizations routing sensitive WAN traffic through the fabric. The extraordinarily broad affected version range (17.x through 20.14.x, hundreds of discrete builds) means virtually all unpatched Catalyst SD-WAN deployments are in scope. |
| Exploit ScenarioDerived | An attacker with a low-privilege SD-WAN Manager or Controller account - obtained via phishing, credential stuffing, or insider access - authenticates to the management API and reads storage artifacts (configuration exports, database dumps, log files, or API responses) containing cleartext administrative passwords or cryptographic keys. With recovered high-privilege credentials, the attacker gains full administrative control of the SD-WAN fabric, enabling policy manipulation, traffic interception, or denial of WAN connectivity across the organization's branch network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
Cleartext storage of sensitive information in Cisco Catalyst SD-WAN Controller and Manager exposes credentials or other security-critical data to authenticated network-accessible attackers, with CVSS 8.8 reflecting the high potential for full system compromise via stolen credentials. Affecting an extraordinarily wide version range spanning 17.2.x through 20.14.x across both the Controller and Manager components, this vulnerability was discovered internally by Cisco's engineering team - a positive signal indicating no known prior adversarial exploitation. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the SD-WAN control plane sensitivity means exposed credentials could enable broad network infrastructure takeover.
RemediationAI
Consult the Cisco Security Advisory cisco-sa-hardening-sdwan-faLcR3K (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K) for exact fixed software versions - specific patched releases are not enumerated in the available data and should not be inferred. The advisory describes these as 'software hardening releases,' indicating the fix involves encrypting or otherwise protecting sensitive data at rest rather than a simple code patch. As compensating controls while patching is scheduled: restrict management-plane access to the SD-WAN Manager and Controller to dedicated out-of-band administrative VLANs or jump hosts, reducing the network attack surface for PR:L exploitation. Audit role-based access control to ensure the minimum required accounts have access to Manager and Controller APIs, limiting the pool of accounts that could be used for exploitation. After patching, rotate all credentials, API tokens, and secrets that may have been stored in the affected components, as previously stored values may have been exposed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Catalyst SD-WAN is an enterprise software-defined WAN fabric consisting of two primary control-plane components: the SD-WAN Controller (formerly vSmart, responsible for policy distribution and OMP routing) and the SD-WAN Manager (formerly vManage, the centralized orchestration and configuration GUI). CWE-312 (Cleartext Storage of Sensitive Information) describes the root cause: security-critical data - typically credentials, API keys, shared secrets, or private keys - is persisted in storage (database, file system, configuration store) without encryption or strong hashing, making it readable to any process or user with storage-level read access. In the SD-WAN context, exposed controller or manager credentials are particularly dangerous because these components hold the policy and routing keys for the entire WAN overlay. The CPE data confirms affected software is cpe:2.3:a:cisco:cisco_catalyst_sd-wan_controller and cpe:2.3:a:cisco:cisco_catalyst_sd-wan_manager with wildcard version scope, corroborated by EUVD-2026-53472 listing hundreds of discrete versions from 17.2.4 through 20.14.1.
Know when Cisco Catalyst Sd Wan Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-312 directly causes confidentiality loss via credential exposure; integrity impact is indirect and availability is not directly attributable to the storage flaw.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20312 are related to Cleartext storage of sensitive information issues that are grouped under the Common Weakness Enumeration (CWE) CWE-312.
Executive ViewAI
Cisco Catalyst SD-WAN Controller and Manager versions 17.2.x through 20.14.x store sensitive credentials in cleartext, exposing authenticated network users to extract credentials that could compromise the entire SD-WAN control plane and orchestrating infrastructure. This vulnerability affects core systems managing enterprise SD-WAN deployments across a broad version range spanning three years of releases. Immediate network access controls and credential rotation are required pending patch availability.
Restrict network-level access to affected Cisco Catalyst SD-WAN Controller and Manager systems through firewall rules and network segmentation, limiting connections to authorized administrative endpoints only; implement credential rotation for all control plane accounts; deploy continuous monitoring and alerting on authentication activity to detect anomalous access patterns; reduce the number of users with credentials to affected systems; consider multi-factor authentication for control plane access if your deployment supports it.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote unauthenticated attackers can bypass peering authentication in Cisco Catalyst SD-WAN Controller (vSmart) and SD-W
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a re
Local privilege escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated netadmin u
Arbitrary file write via path traversal in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticat
Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller st
Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a
Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to
Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files
Remote availability disruption in Cisco Catalyst SD-WAN Manager and Controller allows a low-privileged authenticated att
Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated
Cisco Catalyst SD-WAN Manager's web interface contains a reflected cross-site scripting (XSS) vulnerability that require
Cisco Catalyst SD-WAN Manager web UI fails to properly redact sensitive information in device configurations and templat
Exploit-DB