Cisco Catalyst Sd Wan Manager EUVD-2026-15437

This vulnerability presents moderate real-world risk despite its CVSS 5.4 score. The attack vector is network-based and complexity is low, but it requires both prior authentication (PR:L) and user interaction (UI:R), which meaningfully reduces exploitability compared to unauthenticated XSS. The confined scope (Scope:Changed) and limited impact (Confidentiality:Low, Integrity:Low) further constrain severity. No KEV status or active exploitation data was provided, suggesting this is not currently weaponized in the wild. However, the presence of 20+ affected versions spanning multiple release lines (20.12 through 20.18) indicates a broad installed base requiring patching. Organizations managing critical SD-WAN infrastructure should prioritize updates, but this is not an emergency-tier vulnerability requiring emergency patching; standard patch management timelines are appropriate. The reliance on user interaction (clicking a crafted link) makes this exploitable primarily through spear-phishing or social engineering targeting administrators.

A network administrator receives an email appearing to be from Cisco support containing a link to a management dashboard alert. The link is actually a crafted URL embedding malicious JavaScript payload in a parameter not properly sanitized by the SD-WAN Manager interface. Upon clicking the link while already authenticated to the management portal, the attacker's script executes in the administrator's browser, silently stealing the session cookie and making unauthorized API calls to modify network policy or exfiltrate device inventory data. No additional user action is required beyond clicking the link.