A remote, unauthenticated attacker can craft an XML request that includes an external entity, triggering the SD‑WAN Manager’s XML parser to read files from the underlying system. This insertion of an XXE flaw allows disclosure of arbitrary files that reside on or are accessible by the service. The vulnerability results in direct information disclosure, potentially exposing sensitive configuration files or credentials.

The flaw affects Cisco Catalyst SD‑WAN Manager, the web UI formerly known as SD‑WAN vManage. No specific product version range is supplied in the advisory; therefore, any installation without a mitigation update may be vulnerable. Administrators should verify the exact build against Cisco’s public advisory and apply relevant updates.

With a CVSS base score of 8.6, the issue is classified as high severity. Because the attack requires no user credentials and is remote, the risk is significant, yet the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation would allow a remote actor to read arbitrary files, potentially compromising confidentiality of sensitive data. The lack of authentication and the straightforward request format lower the barrier for exploitation, making the threat notable for exposed SD‑WAN Manager instances.