CVE-2026-20133 - Vulnerability Details

Description

A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system.

This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

Published: 2026-02-25

Score: 6.5 Medium

EPSS: 10.2% Moderate

KEV: Yes

Impact:

Action:

Analysis

Impact

A vulnerability in Cisco Catalyst SD-WAN Manager allows an unauthenticated, remote attacker to view sensitive information on the underlying operating system due to insufficient file system restrictions. The flaw also permits an authenticated attacker with netadmin privileges to access the vshell, enabling reading of protected OS files. This weakness corresponds to CWE-200 and results in confidentiality compromise with no evidence of code execution or privilege escalation.

Affected Systems

Cisco Catalyst SD-WAN Manager, especially versions matching the specified CPEs such as 20.12.6, is affected. All installations without the vendor’s latest fix remain vulnerable.

Risk and Exploitability

The CVSS score of 6.5 denotes medium severity, while the EPSS score of 10% indicates a relatively high likelihood of exploitation. The vulnerability is listed in CISA’s KEV catalog. The attack vector is remote, leveraging insufficient file system permissions or the vshell interface, and the impact is limited to information disclosure.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco Catalyst SD-WAN Manager

affected

Version	Status	Constraints
`17.2.6`	affected	—
`17.2.7`	affected	—
`17.2.8`	affected	—
`17.2.9`	affected	—
`17.2.10`	affected	—
`17.2.4`	affected	—
`17.2.5`	affected	—
`18.3.1.1`	affected	—
`18.3.3.1`	affected	—
`18.3.3`	affected	—
`18.3.4`	affected	—
`18.3.5`	affected	—
`18.3.7`	affected	—
`18.3.8`	affected	—
`18.3.6.1`	affected	—
`18.3.1`	affected	—
`18.3.0`	affected	—
`18.4.0.1`	affected	—
`18.4.3`	affected	—
`18.4.302`	affected	—
`18.4.303`	affected	—
`18.4.4`	affected	—
`18.4.5`	affected	—
`18.4.0`	affected	—
`18.4.1`	affected	—
`18.4.6`	affected	—
`19.2.0`	affected	—
`19.2.097`	affected	—
`19.2.099`	affected	—
`19.2.1`	affected	—
`19.2.2`	affected	—
`19.2.3`	affected	—
`19.2.31`	affected	—
`19.2.929`	affected	—
`19.2.4`	affected	—
`20.1.1.1`	affected	—
`20.1.12`	affected	—
`20.1.1`	affected	—
`20.1.2`	affected	—
`20.1.3`	affected	—
`19.3.0`	affected	—
`19.1.0`	affected	—
`18.2.0`	affected	—
`20.3.1`	affected	—
`20.3.2`	affected	—
`20.3.2.1`	affected	—
`20.3.3`	affected	—
`20.3.3.1`	affected	—
`20.3.4`	affected	—
`20.3.4.1`	affected	—
`20.3.4.2`	affected	—
`20.3.5`	affected	—
`20.3.6`	affected	—
`20.3.7`	affected	—
`20.3.7.1`	affected	—
`20.3.4.3`	affected	—
`20.3.5.1`	affected	—
`20.3.7.2`	affected	—
`20.3.8`	affected	—
`20.4.1`	affected	—
`20.4.1.1`	affected	—
`20.4.1.2`	affected	—
`20.4.2`	affected	—
`20.4.2.2`	affected	—
`20.4.2.1`	affected	—
`20.4.2.3`	affected	—
`20.5.1`	affected	—
`20.5.1.2`	affected	—
`20.5.1.1`	affected	—
`20.6.1`	affected	—
`20.6.1.1`	affected	—
`20.6.2.1`	affected	—
`20.6.2.2`	affected	—
`20.6.2`	affected	—
`20.6.3`	affected	—
`20.6.3.1`	affected	—
`20.6.4`	affected	—
`20.6.5`	affected	—
`20.6.5.1`	affected	—
`20.6.5.3`	affected	—
`20.6.1.2`	affected	—
`20.6.3.2`	affected	—
`20.6.4.1`	affected	—
`20.6.5.2`	affected	—
`20.6.5.4`	affected	—
`20.6.3.3`	affected	—
`20.6.4.2`	affected	—
`20.6.3.0.45`	affected	—
`20.6.3.0.46`	affected	—
`20.6.3.0.47`	affected	—
`20.6.3.4`	affected	—
`20.6.4.0.21`	affected	—
`20.6.5.1.10`	affected	—
`20.6.5.1.11`	affected	—
`20.6.5.1.7`	affected	—
`20.6.5.1.9`	affected	—
`20.6.5.2.4`	affected	—
`20.6.5.5`	affected	—
`20.6.5.2.8`	affected	—
`20.6.5.1.13`	affected	—
`20.6.6`	affected	—
`20.6.7`	affected	—
`20.6.8`	affected	—
`20.7.1`	affected	—
`20.7.1.1`	affected	—
`20.7.2`	affected	—
`20.8.1`	affected	—
`20.9.1`	affected	—
`20.9.2`	affected	—
`20.9.2.1`	affected	—
`20.9.3`	affected	—
`20.9.3.1`	affected	—
`20.9.2.3`	affected	—
`20.9.3.0.12`	affected	—
`20.9.3.0.16`	affected	—
`20.9.3.0.17`	affected	—
`20.9.3.0.18`	affected	—
`20.9.3.0.20`	affected	—
`20.9.3.0.21`	affected	—
`20.9.3.2`	affected	—
`20.9.3.2_LI_Images`	affected	—
`20.9.4`	affected	—
`20.9.4_LI_Images`	affected	—
`20.9.3.0.23`	affected	—
`20.9.4.1`	affected	—
`20.9.5`	affected	—
`20.9.5.1`	affected	—
`20.9.5.2`	affected	—
`20.9.6`	affected	—
`20.9.5.3`	affected	—
`20.9.7`	affected	—
`20.9.7.1`	affected	—
`20.9.8`	affected	—
`20.10.1`	affected	—
`20.10.1.1`	affected	—
`20.10.1.2`	affected	—
`20.11.1`	affected	—
`20.11.1.1`	affected	—
`20.11.1.2`	affected	—
`20.12.1`	affected	—
`20.12.1_LI_Images`	affected	—
`20.12.2`	affected	—
`20.12.3`	affected	—
`20.12.3.1`	affected	—
`20.12.4`	affected	—
`20.12.4.1`	affected	—
`20.12.5`	affected	—
`20.12.5.1`	affected	—
`20.12.5.2`	affected	—
`20.12.6`	affected	—
`20.13.1`	affected	—
`20.14.1`	affected	—
`20.15.1`	affected	—
`20.15.2`	affected	—
`20.15.3`	affected	—
`20.15.3.1`	affected	—
`20.15.4`	affected	—
`20.15.4.1`	affected	—
`20.16.1`	affected	—
`20.18.1`	affected	—
`20.18.2`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
	cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:::::::*

No data.

Vendor Product Confidence Versions

Cisco

Catalyst Sd-wan Manager

91%

Version	Status	Scheme	Platform
`20.1.12`	affected	semver	—
`19.2.1`	affected	semver	—
`18.4.4`	affected	semver	—
`18.4.5`	affected	semver	—
`20.1.1.1`	affected	semver	—
`20.1.1`	affected	semver	—
`19.3.0`	affected	semver	—
`19.2.2`	affected	semver	—
`19.2.099`	affected	semver	—
`18.3.6`	affected	semver	—
`18.3.7`	affected	semver	—
`19.2.0`	affected	semver	—
`18.3.8`	affected	semver	—
`19.0.0`	affected	semver	—
`19.1.0`	affected	semver	—
`18.4.302`	affected	semver	—
`18.4.303`	affected	semver	—
`19.2.097`	affected	semver	—
`19.2.098`	affected	semver	—
`17.2.10`	affected	semver	—
`18.3.6.1`	affected	semver	—
`19.0.1a`	affected	generic	—
`18.2.0`	affected	semver	—
`18.4.3`	affected	semver	—
`18.4.1`	affected	semver	—
`17.2.8`	affected	semver	—
`18.3.3.1`	affected	semver	—
`18.4.0`	affected	semver	—
`18.3.1`	affected	semver	—
`17.2.6`	affected	semver	—
`17.2.9`	affected	semver	—
`18.3.4`	affected	semver	—
`17.2.5`	affected	semver	—
`18.3.1.1`	affected	semver	—
`18.3.5`	affected	semver	—
`18.4.0.1`	affected	semver	—
`18.3.3`	affected	semver	—
`17.2.7`	affected	semver	—
`17.2.4`	affected	semver	—
`18.3.0`	affected	semver	—
`19.2.3`	affected	semver	—
`18.4.501_ES`	affected	generic	—
`20.3.1`	affected	semver	—
`20.1.2`	affected	semver	—
`19.2.929`	affected	semver	—
`19.2.31`	affected	semver	—
`20.3.2`	affected	semver	—
`19.2.32`	affected	semver	—
`20.3.2_925`	affected	semver	—
`20.3.2.1`	affected	semver	—
`20.3.2.1_927`	affected	semver	—
`18.4.6`	affected	semver	—
`20.1.2_937`	affected	semver	—
`20.4.1`	affected	semver	—
`20.3.2_928`	affected	semver	—
`20.3.2_929`	affected	semver	—
`20.4.1.0.1`	affected	semver	—
`20.3.2.1_930`	affected	semver	—
`19.2.4`	affected	generic	—
`20.5.0.1.1`	affected	semver	—
`20.4.1.1`	affected	semver	—
`20.3.3`	affected	semver	—
`19.2.4.0.1`	affected	generic	—
`20.3.3_937`	affected	semver	—
`20.3.3.1`	affected	semver	—
`20.3.3.0.4`	affected	generic	—
`20.3.3.1.2`	affected	generic	—
`20.3.3.1.1`	affected	generic	—
`20.4.1.2`	affected	generic	—
`20.3.3.0.2`	affected	generic	—
`20.4.1.1.5`	affected	generic	—
`20.4.1.0.01`	affected	generic	—
`20.4.1.0.02`	affected	generic	—
`20.3.3.1.7`	affected	generic	—
`20.3.3.1.5`	affected	generic	—
`20.5.1.0.1`	affected	generic	—
`20.3.3.1.10`	affected	generic	—
`20.3.3.0.8`	affected	generic	—
`20.4.2`	affected	generic	—
`20.4.2.0.1`	affected	generic	—
`20.3.4`	affected	generic	—
`20.3.3.0.14`	affected	generic	—
`19.2.4.0.8`	affected	generic	—
`19.2.4.0.9`	affected	generic	—
`20.3.4.0.1`	affected	generic	—
`20.3.2.0.5`	affected	generic	—
`20.6.1`	affected	semver	—
`20.5.1.0.2`	affected	semver	—
`20.3.3.0.17`	affected	generic	—
`20.6.1.1`	affected	semver	—
`20.6.0.18.3`	affected	generic	—
`20.3.2.0.6`	affected	generic	—
`20.6.0.18.4`	affected	generic	—
`20.4.2.0.2`	affected	generic	—
`20.3.3.0.16`	affected	generic	—
`20.3.4.0.5`	affected	generic	—
`20.6.1.0.1`	affected	semver	—
`20.3.4.0.6`	affected	generic	—
`20.6.2`	affected	generic	—
`20.7.1EFT2`	affected	generic	—
`20.3.4.0.9`	affected	generic	—
`20.3.4.0.11`	affected	generic	—
`20.4.2.0.4`	affected	generic	—
`20.3.3.0.18`	affected	generic	—
`20.7.1`	affected	generic	—
`20.6.2.1`	affected	generic	—
`20.3.4.1`	affected	generic	—
`20.5.1.1`	affected	generic	—
`20.4.2.1`	affected	generic	—
`20.4.2.1.1`	affected	generic	—
`20.3.4.1.1`	affected	generic	—
`20.3.813`	affected	generic	—
`20.3.4.0.19`	affected	generic	—
`20.4.2.2.1`	affected	generic	—
`20.5.1.2`	affected	generic	—
`20.3.4.2`	affected	generic	—
`20.3.814`	affected	generic	—
`20.4.2.2`	affected	generic	—
`20.6.2.2`	affected	generic	—
`20.3.4.2.1`	affected	generic	—
`20.7.1.1`	affected	generic	—
`20.3.4.1.2`	affected	generic	—
`20.6.2.2.2`	affected	generic	—
`20.3.4.0.20`	affected	generic	—
`20.6.2.2.3`	affected	generic	—
`20.4.2.2.2`	affected	generic	—
`20.3.5`	affected	generic	—
`20.6.2.0.4`	affected	generic	—
`20.4.2.2.3`	affected	generic	—
`20.3.4.0.24`	affected	generic	—
`20.6.2.2.7`	affected	generic	—
`20.6.3`	affected	generic	—
`20.3.4.2.2`	affected	generic	—
`20.4.2.2.4`	affected	generic	—
`20.7.1.0.2`	affected	generic	—
`20.8.1`	affected	generic	—
`20.3.5.0.8`	affected	generic	—
`20.3.5.0.9`	affected	generic	—
`20.4.2.2.8`	affected	generic	—
`20.3.5.0.7`	affected	generic	—
`20.6.3.0.7`	affected	generic	—
`20.6.3.0.5`	affected	generic	—
`20.6.3.0.10`	affected	generic	—
`20.6.3.0.2`	affected	generic	—
`20.7.2`	affected	generic	—
`20.9.1EFT2`	affected	generic	—
`20.6.3.0.11`	affected	generic	—
`20.6.3.1`	affected	generic	—
`20.6.3.0.14`	affected	generic	—
`20.6.4`	affected	generic	—
`20.9.1`	affected	generic	—
`20.6.3.0.19`	affected	generic	—
`20.6.3.0.18`	affected	generic	—
`20.3.6`	affected	semver	—
`20.9.1.1`	affected	generic	—
`20.6.3.0.23`	affected	generic	—
`20.6.4.0.4`	affected	generic	—
`20.6.3.0.25`	affected	generic	—
`20.6.5`	affected	generic	—
`20.6.3.0.27`	affected	generic	—
`20.9.2`	affected	generic	—
`20.9.2.1`	affected	generic	—
`20.6.3.0.29`	affected	generic	—
`20.6.3.0.31`	affected	generic	—
`20.6.3.0.32`	affected	generic	—
`20.10.1`	affected	semver	—
`20.6.3.0.33`	affected	generic	—
`20.9.2.0.01`	affected	generic	—
`20.9.1_LI_Images`	affected	generic	—
`20.10.1_LI_Images`	affected	generic	—
`20.9.2_LI_Images`	affected	generic	—
`20.3.7`	affected	semver	—
`20.9.3`	affected	generic	—
`20.6.5.1`	affected	generic	—
`20.11.1`	affected	semver	—
`20.12.1`	affected	generic	—
`20.12.1_LI_Images`	affected	generic	—
`20.9.3_LI_ Images`	affected	generic	—
`20.6.3.1.1`	affected	generic	—
`20.9.3.0.2`	affected	generic	—
`20.6.5.1.2`	affected	generic	—
`20.9.3.0.3`	affected	generic	—
`20.4.2.3`	affected	generic	—
`20.6.3.2`	affected	generic	—
`20.6.4.1`	affected	generic	—
`20.6.3.0.38`	affected	generic	—
`20.6.3.0.39`	affected	generic	—
`20.3.5.1`	affected	generic	—
`20.3.4.3`	affected	generic	—
`20.9.3.1`	affected	generic	—
`20.3.3.2`	affected	generic	—
`20.6.5.2`	affected	generic	—
`20.3.7.1`	affected	generic	—
`20.10.1.1`	affected	semver	—
`20.6.5.2.1`	affected	generic	—
`20.3.4.0.25`	affected	generic	—
`20.6.2.2.4`	affected	generic	—
`20.6.1.2`	affected	generic	—
`20.11.1.1`	affected	semver	—
`20.9.3.0.5`	affected	generic	—
`20.3.4.0.26`	affected	generic	—
`20.6.5.1.3`	affected	generic	—
`20.6.3.0.40`	affected	generic	—
`20.1.3`	affected	generic	—
`20.9.2.2`	affected	generic	—
`20.6.5.2.3`	affected	generic	—
`20.6.5.1.4`	affected	generic	—
`20.6.5.3`	affected	generic	—
`20.6.3.0.41`	affected	generic	—
`20.9.3.0.7`	affected	generic	—
`20.6.5.1.5`	affected	generic	—
`20.9.3.0.4`	affected	generic	—
`20.6.4.0.19`	affected	generic	—
`20.6.5.1.6`	affected	generic	—
`20.9.3.0.8`	affected	generic	—
`20.6.3.3`	affected	generic	—
`20.3.7.2`	affected	generic	—
`20.6.5.4`	affected	generic	—
`20.6.5.1.7`	affected	generic	—
`20.9.3.0.12`	affected	generic	—
`20.6.4.2`	affected	generic	—
`20.6.5.5`	affected	generic	—
`20.9.3.2`	affected	generic	—
`20.11.1.2`	affected	generic	—
`20.6.3.4`	affected	generic	—
`20.10.1.2`	affected	generic	—
`20.6.5.1.9`	affected	generic	—
`20.9.3.0.16`	affected	generic	—
`20.6.3.0.45`	affected	generic	—
`20.6.5.1.10`	affected	generic	—
`20.9.3.0.17`	affected	generic	—
`20.6.5.2.4`	affected	generic	—
`20.6.4.0.21`	affected	generic	—
`20.9.3.0.18`	affected	generic	—
`20.6.3.0.46`	affected	generic	—
`20.6.3.0.47`	affected	generic	—
`20.9.2.3`	affected	generic	—
`20.9.3.2_LI_Images`	affected	generic	—
`20.9.3.0.21`	affected	generic	—
`20.9.3.0.20`	affected	generic	—
`20.9.4_LI_Images`	affected	generic	—
`20.9.4`	affected	generic	—
`20.6.5.1.11`	affected	generic	—
`20.12.1`	affected	generic	—
`20.13.1_LI_Images`	affected	generic	—
`20.9.4.0.4`	affected	generic	—
`20.13.1`	affected	generic	—
`20.9.4.1.1`	affected	generic	—
`20.9.5`	affected	generic	—
`20.9.5_LI_Images`	affected	generic	—
`20.12.3_LI_Images`	affected	generic	—
`20.12.3`	affected	generic	—
`20.9.4.1.3`	affected	generic	—
`20.6.7`	affected	generic	—
`20.9.5.1`	affected	generic	—
`20.9.5.1_LI_Images`	affected	generic	—
`20.9.4.1.6`	affected	generic	—
`20.14.1`	affected	generic	—
`20.14.1_LI_Images`	affected	generic	—
`20.9.5.2`	affected	generic	—
`20.9.5.2.1`	affected	generic	—
`20.12.4`	affected	generic	—
`20.16.1`	affected	generic	—
`20.12.4.0.03`	affected	generic	—
`20.12.401`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Cisco Catalyst SD-WAN Manager patch to mitigate insufficient file system access restrictions.
If a patch cannot be applied immediately, isolate the SD-WAN Manager service from external networks and restrict API access to trusted internal hosts only.
Enforce file system permissions so the SD-WAN Manager process cannot read sensitive OS directories, tightening access control for protected files.

Generated by OpenCVE AI on June 24, 2026 at 12:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since April 20, 2026.

The EPSS score is 0.10245.

Exploitation active

Automatable no

Technical Impact partial

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20133

History

Wed, 24 Jun 2026 05:15:00 +0000

Type	Values Removed	Values Added
Title	Remote Information Disclosure via Insufficient File System Restrictions in Cisco Catalyst SD-WAN Manager

Wed, 24 Jun 2026 00:00:00 +0000

Type	Values Removed	Values Added
Title		Remote Information Disclosure via Insufficient File System Restrictions in Cisco Catalyst SD-WAN Manager

Tue, 23 Jun 2026 19:30:00 +0000

Type	Values Removed	Values Added
Title	Information Disclosure via Insufficient File System Restrictions in Cisco Catalyst SD-WAN Manager

Tue, 23 Jun 2026 15:30:00 +0000

Type	Values Removed	Values Added
Title		Information Disclosure via Insufficient File System Restrictions in Cisco Catalyst SD-WAN Manager

Thu, 18 Jun 2026 16:45:00 +0000

Type	Values Removed	Values Added
Title	Information Disclosure via Insufficient File System Restrictions in Cisco Catalyst SD-WAN Manager

Wed, 17 Jun 2026 10:00:00 +0000

Type	Values Removed	Values Added
Title		Information Disclosure via Insufficient File System Restrictions in Cisco Catalyst SD-WAN Manager

Tue, 16 Jun 2026 12:00:00 +0000

Type	Values Removed	Values Added
Title	Information Disclosure via File System Restrictions in Cisco Catalyst SD-WAN Manager

Tue, 28 Apr 2026 09:45:00 +0000

Type	Values Removed	Values Added
Title		Information Disclosure via File System Restrictions in Cisco Catalyst SD-WAN Manager

Wed, 22 Apr 2026 16:30:00 +0000

Type	Values Removed	Values Added
Title	Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability

Wed, 22 Apr 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description	A vulnerability in Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system access restrictions. An attacker could exploit this vulnerability by accessing the API of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.	A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

Mon, 20 Apr 2026 20:15:00 +0000

Type	Values Removed	Values Added
References		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20133
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 20 Apr 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		kev `{'dateAdded': '2026-04-20T00:00:00+00:00', 'dueDate': '2026-04-23T00:00:00+00:00'}`

Wed, 04 Mar 2026 21:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:cisco:catalyst_sd-wan_manager:::::::: cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:::::::*

Fri, 27 Feb 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 26 Feb 2026 13:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco catalyst Sd-wan Manager
Vendors & Products		Cisco Cisco catalyst Sd-wan Manager

Wed, 25 Feb 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system access restrictions. An attacker could exploit this vulnerability by accessing the API of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.
Title		Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
Weaknesses		CWE-200
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

Subscriptions

Cisco Catalyst Sd-wan Manager

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2026-02-25T16:13:56.017Z

Updated: 2026-04-22T15:31:56.704Z

Reserved: 2025-10-08T11:59:15.380Z

Link: CVE-2026-20133

Vulnrichment

Updated: 2026-02-25T18:17:58.540Z

NVD

Status : Analyzed

Published: 2026-02-25T17:25:30.983

Modified: 2026-06-17T10:17:11.190

Link: CVE-2026-20133

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-06-24T12:45:04Z

Weaknesses

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation active

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object