EUVD-2026-30327
GHSA-f8xf-95r6-r95h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain read-only credentials
-
DeliveryAccess audit logs via UI
-
ExploitExtract high-privilege session token
-
ExecutionReplay or inject token
-
PersistAuthenticate as administrator
-
ImpactExecute high-privilege actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Logging volume control
|
| Exploitation Conditions | Exploitation requires the attacker to already possess valid read-only user credentials for Cisco Catalyst SD-WAN Manager. The vulnerability depends on read-only users retaining access to audit logs containing sensitive session information - if audit log access is restricted to administrators only, exploitation is blocked. The attack succeeds only if the audit logging feature is enabled and retains session tokens or credentials in plaintext or easily reversible form. Exploitation does not require administrative access, multi-factor authentication bypass, or non-default configuration; it leverages the default behavior of audit logging in a way accessible to low-privileged accounts. Attackers cannot exploit this vulnerability without initial network access to the SD-WAN Manager web UI and a valid read-only user account. |
| Impact | CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U) indicates network-accessible privilege escalation requiring only low privileges and no user interaction - a direct attack path. However, real-world risk depends on organizational segregation of read-only versus administrative roles. In environments where read-only accounts are widely distributed (e.g., NOC staff, partner access), exploitation likelihood is high; in tightly controlled environments, risk is lower. The AC:L rating reflects that audit log access and session extraction require no special conditions, making this practically exploitable. EPSS data not provided, limiting predictive modeling. No KEV status or POC availability confirmed in input data, suggesting either limited public disclosure or targeted rather than mass exploitation. The information disclosure nature (C:L/I:L/A:N) and lack of availability impact mean this is primarily a lateral privilege escalation tool, not a denial-of-service or confidentiality breach of SD-WAN traffic itself. Risk assessment is MODERATE for organizations with strict RBAC, HIGH for deployments with permissive read-only access or shared credentials. |
| Exploit ScenarioDerived | A network operations center (NOC) engineer with read-only SD-WAN Manager access logs into the platform to monitor link status. The attacker accesses the audit logs via the UI or API (accessible to read-only users) and extracts a recent session token or credential for a network administrator account. The attacker then either replays the token to authenticate as the administrator or uses the extracted credentials to establish a new high-privilege session. Within minutes, the attacker gains administrative access and can reconfigure SD-WAN policies, modify network routing, or exfiltrate sensitive network data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 14, 2026
Privilege escalation in Cisco Catalyst SD-WAN Manager allows authenticated users with read-only permissions to elevate privileges to high-privileged user level through exposure of sensitive session information in audit logs. An attacker with initial read-only access can extract high-privilege session credentials from audit logs and impersonate an administrator, bypassing intended access controls. CVSS score 5.4 (medium) reflects the requirement for initial authentication, though the ease of escalation (AC:L) and direct path to administrative capability represent significant risk in multi-tenant or shared SD-WAN deployments.
RemediationAI
Cisco has released security advisories at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk and https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R; consult these advisories immediately for patched version numbers and deployment guidance. Primary mitigation is upgrading Cisco Catalyst SD-WAN Manager to the patched release. Interim compensating controls include: (1) Restrict audit log access to administrators only, removing read-only user visibility of session data - trade-off is reduced auditability for non-admin staff; (2) Disable or restrict the audit logging feature if not required for compliance, eliminating the exposure vector - verify regulatory and operational requirements before disabling; (3) Implement network segmentation to limit which users can access the Manager's web UI, reducing the pool of low-privileged attackers; (4) Monitor audit logs for patterns indicating privilege escalation attempts (e.g., low-privilege users establishing high-privilege sessions shortly after audit log access). These controls do not fix the root cause and should be temporary pending patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) is a centralized management platform for SD-WAN infrastructure. The vulnerability stems from CWE-779 (Improper Logging of Sensitive Information), where sensitive session tokens or authentication data associated with high-privileged accounts are logged in audit trails accessible to lower-privileged users. SD-WAN Manager's audit logging mechanism, intended for compliance and troubleshooting, inadvertently preserves session identifiers or credentials that can be replayed or used to establish authenticated sessions as privileged users. This breaks the principle of least privilege by allowing the audit system itself to become an escalation vector.
Know when Cisco Catalyst Sd Wan Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker with read-only permissions to elevate their privileges from low to high and perform actions as a high-privileged user.
This vulnerability exists because sensitive session information is recorded in audit logs. An attacker could exploit this vulnerability by elevating their read-only permissions in Cisco Catalyst SD-WAN Manager to those of a high-privileged user. A successful exploit could allow the attacker to perform actions as a high-privileged user.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote unauthenticated attackers can bypass peering authentication in Cisco Catalyst SD-WAN Controller (vSmart) and SD-W
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a re
Local privilege escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated netadmin u
Arbitrary file write via path traversal in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticat
Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller st
Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a
Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to
Cleartext storage of sensitive information in Cisco Catalyst SD-WAN Controller and Manager exposes credentials or other
Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files
Remote availability disruption in Cisco Catalyst SD-WAN Manager and Controller allows a low-privileged authenticated att
Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated
Cisco Catalyst SD-WAN Manager's web interface contains a reflected cross-site scripting (XSS) vulnerability that require
Exploit-DB