HackZoneLabs News
Newsletter

CVE-2026-20133

Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

  • Medium 6.5
  • Exploited: added to CISA KEV 20 Apr 2026

Description

A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

Key facts

Published
25 Feb 2026
Last changed
22 Apr 2026
Assigned by
cisco
KEV added
20 Apr 2026
KEV fix due
23 Apr 2026
EPSS
35.29% likely to be exploited in the next 30 days, higher than 98.472% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: active; Automatable: no; Technical impact: partial

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 6.5CVSS 3.1, Mediumfrom the CNA (cisco)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What to do

  • Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
CiscoCisco Catalyst SD-WAN Manager
  • 17.2.6 (affected)
  • 17.2.7 (affected)
  • 17.2.8 (affected)
  • 17.2.9 (affected)
  • 17.2.10 (affected)
  • 17.2.4 (affected)
  • 17.2.5 (affected)
  • 18.3.1.1 (affected)
  • 18.3.3.1 (affected)
  • 18.3.3 (affected)
  • 18.3.4 (affected)
  • 18.3.5 (affected)
  • 18.3.7 (affected)
  • 18.3.8 (affected)
  • 18.3.6.1 (affected)
  • 18.3.1 (affected)
  • 18.3.0 (affected)
  • 18.4.0.1 (affected)
  • 18.4.3 (affected)
  • 18.4.302 (affected)
  • 18.4.303 (affected)
  • 18.4.4 (affected)
  • 18.4.5 (affected)
  • 18.4.0 (affected)
  • 18.4.1 (affected)
  • 18.4.6 (affected)
  • 19.2.0 (affected)
  • 19.2.097 (affected)
  • 19.2.099 (affected)
  • 19.2.1 (affected)
  • 19.2.2 (affected)
  • 19.2.3 (affected)
  • 19.2.31 (affected)
  • 19.2.929 (affected)
  • 19.2.4 (affected)
  • 20.1.1.1 (affected)
  • 20.1.12 (affected)
  • 20.1.1 (affected)
  • 20.1.2 (affected)
  • 20.1.3 (affected)
  • 19.3.0 (affected)
  • 19.1.0 (affected)
  • 18.2.0 (affected)
  • 20.3.1 (affected)
  • 20.3.2 (affected)
  • 20.3.2.1 (affected)
  • 20.3.3 (affected)
  • 20.3.3.1 (affected)
  • 20.3.4 (affected)
  • 20.3.4.1 (affected)
  • 20.3.4.2 (affected)
  • 20.3.5 (affected)
  • 20.3.6 (affected)
  • 20.3.7 (affected)
  • 20.3.7.1 (affected)
  • 20.3.4.3 (affected)
  • 20.3.5.1 (affected)
  • 20.3.7.2 (affected)
  • 20.3.8 (affected)
  • 20.4.1 (affected)
  • 20.4.1.1 (affected)
  • 20.4.1.2 (affected)
  • 20.4.2 (affected)
  • 20.4.2.2 (affected)
  • 20.4.2.1 (affected)
  • 20.4.2.3 (affected)
  • 20.5.1 (affected)
  • 20.5.1.2 (affected)
  • 20.5.1.1 (affected)
  • 20.6.1 (affected)
  • 20.6.1.1 (affected)
  • 20.6.2.1 (affected)
  • 20.6.2.2 (affected)
  • 20.6.2 (affected)
  • 20.6.3 (affected)
  • 20.6.3.1 (affected)
  • 20.6.4 (affected)
  • 20.6.5 (affected)
  • 20.6.5.1 (affected)
  • 20.6.5.3 (affected)
  • 20.6.1.2 (affected)
  • 20.6.3.2 (affected)
  • 20.6.4.1 (affected)
  • 20.6.5.2 (affected)
  • 20.6.5.4 (affected)
  • 20.6.3.3 (affected)
  • 20.6.4.2 (affected)
  • 20.6.3.0.45 (affected)
  • 20.6.3.0.46 (affected)
  • 20.6.3.0.47 (affected)
  • 20.6.3.4 (affected)
  • 20.6.4.0.21 (affected)
  • 20.6.5.1.10 (affected)
  • 20.6.5.1.11 (affected)
  • 20.6.5.1.7 (affected)
  • 20.6.5.1.9 (affected)
  • 20.6.5.2.4 (affected)
  • 20.6.5.5 (affected)
  • 20.6.5.2.8 (affected)
  • 20.6.5.1.13 (affected)
  • 20.6.6 (affected)
  • 20.6.7 (affected)
  • 20.6.8 (affected)
  • 20.7.1 (affected)
  • 20.7.1.1 (affected)
  • 20.7.2 (affected)
  • 20.8.1 (affected)
  • 20.9.1 (affected)
  • 20.9.2 (affected)
  • 20.9.2.1 (affected)
  • 20.9.3 (affected)
  • 20.9.3.1 (affected)
  • 20.9.2.3 (affected)
  • 20.9.3.0.12 (affected)
  • 20.9.3.0.16 (affected)
  • 20.9.3.0.17 (affected)
  • 20.9.3.0.18 (affected)
  • 20.9.3.0.20 (affected)
  • 20.9.3.0.21 (affected)
  • 20.9.3.2 (affected)
  • 20.9.3.2_LI_Images (affected)
  • 20.9.4 (affected)
  • 20.9.4_LI_Images (affected)
  • 20.9.3.0.23 (affected)
  • 20.9.4.1 (affected)
  • 20.9.5 (affected)
  • 20.9.5.1 (affected)
  • 20.9.5.2 (affected)
  • 20.9.6 (affected)
  • 20.9.5.3 (affected)
  • 20.9.7 (affected)
  • 20.9.7.1 (affected)
  • 20.9.8 (affected)
  • 20.10.1 (affected)
  • 20.10.1.1 (affected)
  • 20.10.1.2 (affected)
  • 20.11.1 (affected)
  • 20.11.1.1 (affected)
  • 20.11.1.2 (affected)
  • 20.12.1 (affected)
  • 20.12.1_LI_Images (affected)
  • 20.12.2 (affected)
  • 20.12.3 (affected)
  • 20.12.3.1 (affected)
  • 20.12.4 (affected)
  • 20.12.4.1 (affected)
  • 20.12.5 (affected)
  • 20.12.5.1 (affected)
  • 20.12.5.2 (affected)
  • 20.12.6 (affected)
  • 20.13.1 (affected)
  • 20.14.1 (affected)
  • 20.15.1 (affected)
  • 20.15.2 (affected)
  • 20.15.3 (affected)
  • 20.15.3.1 (affected)
  • 20.15.4 (affected)
  • 20.15.4.1 (affected)
  • 20.16.1 (affected)
  • 20.18.1 (affected)
  • 20.18.2 (affected)

Timeline

  1. 25 Feb 2026 Published
  2. 20 Apr 2026 Added to the CISA KEV catalogue

Weakness

References