CVE-2026-20128 Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format

Exploited in the wild High 7.5 Published 25 Feb 2026 Updated 21 Apr 2026

An unauthenticated remote attacker can read a credential file to gain DCA user privileges on Cisco Catalyst SD-WAN Manager systems.

Exploited in the wild: Since 20 Apr 2026
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-20128?

CVE-2026-20128 is a high-severity vulnerability in Cisco Catalyst Sd-Wan Manager, published on 25 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.

Weakness: CWE-257

Which versions are affected by CVE-2026-20128?

It affects 1 product.

Products include Cisco Catalyst Sd-Wan Manager.

How do I fix CVE-2026-20128?

No fix has been published for CVE-2026-20128 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 23 Apr 2026.

Is CVE-2026-20128 being exploited?

Yes. Attackers have exploited CVE-2026-20128 in the wild since at least 20 Apr 2026.

All Cisco Catalyst Sd-Wan Manager vulnerabilities

Sources

Also known as GHSA-mp6j-7g85-8pg2.