ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-20133

Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Published Feb 25, 2026 · catalog updated Jun 17, 2026 · Cisco Catalyst SD-WAN Manager

Patch now

CVE-2026-20133 is in the CISA known-exploited catalog, due Apr 23, 2026. Confirm Cisco Catalyst SD-WAN Manager against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Severity
High7.5
Known exploitation
CISA KEV and VulnCheck KEV
EPSS
32.43%
Remediation
Remediation guidance
Affected products
cpe cisco/catalyst sd-wan manager · vendor Cisco Catalyst SD-WAN Manager

A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe cisco/catalyst sd-wan manager20.12.6
  • vendor Cisco Catalyst SD-WAN Managerversion unspecified

How to fix CVE-2026-20133

  • Recommended remediation

    Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. CISA due date Apr 23, 2026.

  • Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2026-20133 is in the CISA known-exploited catalog, due Apr 23, 2026. Confirm Cisco Catalyst SD-WAN Manager against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Compare what you have installed with cisco/catalyst sd-wan manager 20.12.6. Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

What should an analyst verify?

CWE-200: Exposure of Sensitive Information. EPSS 32.43%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Cisco security

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 25, 2026 · Catalog

    Detected

    A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to r

  2. Apr 20, 2026 · CISA KEV

    Known exploited

    Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not av

  3. Apr 23, 2026 · CISA KEV

    Remediation due

    Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not av

  4. Jun 17, 2026 · Catalog

    Updated

    A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to r

  5. Jun 17, 2026 · NIST NVD

    Updated

    A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to r

Sources

  • CISA KEVConfirmed exploitationCVE-2026-20133

    Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2026-20133

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-20133

    30-day exploitation probability 32.4%

    first.org
  • NIST NVDVulnerability recordCVE-2026-20133

    A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could e

    nvd.nist.gov
  • VulnCheck KEVConfirmed exploitationCVE-2026-20133

    Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.

    vulncheck.com

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.