CVE-2026-20133

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-20133 6.5

Cisco · Catalyst SD-WAN Manager · Added 2026-04-20 · Published 2026-02-25

KEV Active Exploitation

Details

VulnerabilityCisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

VendorCisco

ProductCatalyst SD-WAN Manager

Date added2026-04-20

Due date2026-04-23

CISA catalogView on CISA KEV catalog

Required actionPlease adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

CWECWE-200

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Descriptions

KEV: Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.

NVD: A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

Compliance SSVC + BOD 26-04

Automatableno

Technical impactpartial

Exploitation statusactive

3-day qualifyingNo

Public timeline14 days

Non-public timeline14 days

Forensic (public)Not required

Forensic (non-public)Not required

Research metadata

Last researched2026-06-13 04:02 UTC

Wall time0.4s

Searches4

Component defaultyes

Sources https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory?cve=CVE-2026-20133
https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-authbp-qwCX8D4v.html
https://nvd.nist.gov/vuln/detail/CVE-2026-20133
https://www.decryptiondigest.com/blog/cisco-sdwan-cve-2026-20133-credential-chain-attack
https://alexanderconstantinou.uk/blog/posts/cve-2026-20122-20128-20133-cisco-sdwan.html
https://www.vulncheck.com/blog/cisco-sd-wan-manager-vulns
https://docs.vulncheck.com/initial-access/2026-03-13
https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-and-partners-release-guidance-ongoing-global-exploitation-cisco-sd-wan-systems

QC notes

warn component_extraction: Component 'Cisco Catalyst SD-WAN Manager REST API (vshell file system access via /dataservice/ and /api/ endpoints with insufficient path restriction, exposing the underlying OS filesystem to unauthenticated path traversal)' matches or contains product name 'Catalyst SD-WAN Manager' — no specific component identified

Hunting hypothesis agent

Monitor for vshell sessions on Cisco Catalyst SD-WAN Manager where netadmin users attempt to read sensitive OS files outside permitted paths by exploiting insufficient file system restrictions.

Research details

ComponentCisco Catalyst SD-WAN Manager REST API (vshell file system access via /dataservice/ and /api/ endpoints with insufficient path restriction, exposing the underlying OS filesystem to unauthenticated path traversal)

PreconditionsNetwork access to the SD-WAN Manager web management interface (TCP 443, 8443, or 8080); No authentication required (Cisco advisory CVSS vector PR:N — unauthenticated); Target running a vulnerable Cisco Catalyst SD-WAN Manager release (20.x prior to fixed versions); Attacker sends crafted HTTP GET requests with path traversal sequences (../, ..%2F, %2E%2E%2F) to API endpoints agent

Public PoCno

Advisoryhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory?cve=CVE-2026-20133

Exploit notesCVSS attack complexity: LOW (Cisco advisory CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); exploitation is trivial — unauthenticated attacker sends crafted HTTP GET requests to SD-WAN Manager API with path traversal sequences (e.g., /api/v1/../../../../etc/passwd) to read arbitrary files; can leak TLS/SSL private keys, credential stores, config files, and confd_ipc_secret (allowing local privilege escalation to root); actively chained with CVE-2026-20128 and CVE-2026-20122 in the wild by threat actor UAT-8616

SummaryCVE-2026-20133 is an unauthenticated information disclosure vulnerability in Cisco Catalyst SD-WAN Manager (formerly vManage). The root cause is insufficient file system access restrictions in the REST API layer — an unauthenticated remote attacker can send crafted HTTP GET requests with path traversal sequences to read arbitrary sensitive files from the underlying OS, including TLS/SSL private keys, configuration files with hardcoded credentials, DCA credential stores, and confd_ipc_secret (which enables local privilege escalation to root). Discovered internally by Cisco (Bug ID CSCws33583). Patched in releases 20.9.8.2, 20.12.5.3, 20.15.4.2, 20.18.2.1. Actively exploited in the wild by threat actor UAT-8616 as the entry point in a 3-CVE chain (CVE-2026-20133 → CVE-2026-20128 → CVE-2026-20122) to achieve full system compromise. Added to CISA KEV on 2026-04-20 with federal deadline of 2026-04-23.

Tia coverage

First reported2026-05-15

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisco-sd-wan-zero-day-cve-2026-20182-6th-exploited-flaw-in-2026

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.