A flaw in the web interface of Cisco Catalyst SD‑WAN Manager, formerly known as vManage, permits an authenticated attacker that already has read‑only access to gain high‑privileged rights. The vulnerability arises because sensitive session data is logged in audit records, enabling the attacker to promote their permissions from read‑only to high. An attacker who successfully exploits this flaw can execute any operation that a high‑privileged user is authorized to perform, potentially compromising network configuration and control.

Cisco Catalyst SD‑WAN Manager is the sole affected product listed by the CNA. No specific version range is provided, so all installations of the SD‑WAN Manager that use the web UI remain potentially vulnerable until a patch is applied.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests that it is not currently exploited in the wild or has limited public exploitation data. The attack path requires an authenticated session with read‑only permissions, accessed remotely via the web UI. Once the attacker’s session is logged, they can elevate privileges in a single step, after which they can manipulate network management functions. Because this requires only read‑only access, any user with such a role is a potential attack surface.