EUVD-2026-53468
GHSA-cxh6-m3r9-wj58
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege SD-WAN Manager account
-
DeliveryAccess log viewer in web management UI
-
ExploitIdentify unencrypted template log entries
-
ExecutionExtract cleartext authentication credentials
-
PersistAuthenticate to WAN edge devices or upstream infrastructure
-
ImpactExpand access across SD-WAN fabric
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V12 - Secure Communication Transport encryption
|
| Exploitation Conditions | Exploitation requires a valid low-privileged authenticated account on the Cisco Catalyst SD-WAN Manager web-based management interface - PR:L per the CVSS vector confirms authentication is mandatory. The attacker must additionally have access to either local system logs on the SD-WAN Manager host or a remote logging server configured to receive SD-WAN Manager syslog output; without log access, the cleartext credentials cannot be retrieved. The vulnerability is present when template types excluded from the encryption allowlist are in use, which is likely a common operational state given the breadth of affected versions. Limiting factors: unauthenticated exploitation is not possible; an account, even low-privileged, must first be provisioned; organizations restricting log access to dedicated log-review roles reduce exposure; deployments with no remote syslog configured limit exposure to the local system. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects a low-barrier, network-accessible information disclosure requiring only a low-privileged authenticated account - a realistic scenario in enterprise environments where multiple operators share the management plane with varying privilege levels. The high confidentiality impact is justified because the exposed data is authentication credentials, not generic operational telemetry; credential theft in an SD-WAN context can yield administrative access to WAN edge devices across the entire fabric. No EPSS score was provided in the input data, preventing quantitative exploitation probability assessment. The vulnerability is not in CISA KEV, and no POC has been identified, suggesting it has not yet been operationalized by threat actors. Despite the absence of active exploitation signals, the low exploitation barrier (authenticated-only, no special permissions, no interaction required) and the high downstream impact of stolen SD-WAN credentials elevate practical risk above what the base CVSS score alone conveys. The Scope:Unchanged rating is technically correct at the vulnerability level but understates the post-exploitation blast radius. |
| Exploit ScenarioDerived | An attacker who has obtained or been granted a low-privileged operator account on Cisco Catalyst SD-WAN Manager navigates to the system log viewer within the web management interface, or accesses a remote syslog server receiving SD-WAN Manager output. By examining log entries associated with template operations, the attacker reads cleartext authentication credentials embedded in unencrypted template data. These credentials - potentially device authentication tokens, RADIUS/TACACS keys, or administrative passwords - are then reused to authenticate directly to WAN edge devices or upstream network infrastructure, escalating the attacker's access well beyond the initial management plane foothold. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated low-privileged remote attacker to read sensitive authentication material from system logs. The root cause is an incomplete encryption allowlist: specific template types are excluded from the encryption policy, resulting in sensitive values being written to logs in cleartext - accessible both on the local system and on any configured remote logging server. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but successful exploitation directly enables credential theft that can cascade into broader SD-WAN infrastructure compromise.
RemediationAI
Consult the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-infodis-SPuJBDCe for specific fixed-version guidance - the input data does not include an explicit patched release identifier, so citing a version here would be speculative. Until a patched version is applied, prioritize restricting access to the SD-WAN Manager web interface to only trusted, named administrator accounts and eliminating shared low-privilege credentials. Audit and restrict which systems receive SD-WAN Manager log streams, as remote syslog servers represent an additional exposure point; apply access controls to logging infrastructure that are equivalent to those on the management plane itself. Rotate any authentication credentials that may have transited SD-WAN Manager logs, particularly credentials used in device templates, as these are most likely to appear in cleartext. Monitor low-privileged account access to log viewer functionality as a compensating detection control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Catalyst SD-WAN Manager (formerly vManage) is the centralized orchestration and management plane for Cisco's SD-WAN fabric. It manages device templates, policy configurations, and credentials across all WAN edge devices. CWE-319 (Cleartext Transmission of Sensitive Information) identifies the root cause: the application maintains an encryption allowlist for template types but fails to include all sensitive template categories, leaving authentication credentials unprotected when serialized to log output. The affected CPE cpe:2.3:a:cisco:cisco_catalyst_sd-wan_manager:*:*:*:*:*:*:*:* spans a wide version range from 17.x through 26.x per EUVD data, indicating a long-standing design gap rather than a recent regression. Remote logging configurations extend the exposure surface beyond the local system to any syslog infrastructure receiving SD-WAN Manager log streams.
Know when Cisco Catalyst Sd Wan Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible management interface; low privilege required per description; high confidentiality due to cleartext credential exposure; no integrity or availability impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system.
This vulnerability is due to insufficient access control enforcement for specific template types that are not included in the encryption allowlist. A low-privileged attacker could exploit this vulnerability by viewing logs on the local system or on a remote logging server. A successful exploit could allow the attacker to view sensitive authentication credentials, which could lead to further compromise of network infrastructure and connected services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote unauthenticated attackers can bypass peering authentication in Cisco Catalyst SD-WAN Controller (vSmart) and SD-W
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a re
Local privilege escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated netadmin u
Arbitrary file write via path traversal in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticat
Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller st
Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a
Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to
Cleartext storage of sensitive information in Cisco Catalyst SD-WAN Controller and Manager exposes credentials or other
Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files
Remote availability disruption in Cisco Catalyst SD-WAN Manager and Controller allows a low-privileged authenticated att
Cisco Catalyst SD-WAN Manager's web interface contains a reflected cross-site scripting (XSS) vulnerability that require
Cisco Catalyst SD-WAN Manager web UI fails to properly redact sensitive information in device configurations and templat
Exploit-DB