CVE-2026-20128
Cisco Catalyst Sd-Wan Manager ≤ 20.9.8.2
Raw vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2026-20128 is a high-severity Storing Passwords in a Recoverable Format (CWE-257) vulnerability in Cisco Catalyst Sd-Wan Manager. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Group Policy Preferences (T1552.006); ranked in the top 6% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager stems from the presence of a credential file containing the DCA user password on affected systems. The flaw, tracked as CVE-2026-20128 and assigned CWE-257, enables an attacker to retrieve the stored password and is present in releases prior to 20.18.
An unauthenticated remote attacker can exploit the issue by sending a crafted HTTP request that exposes the credential file, thereby obtaining DCA user privileges on the target system and potentially pivoting to additional affected devices. The CVSS 3.1 score of 7.5 reflects high impact on confidentiality, integrity, and availability under local access conditions with high attack complexity.
Cisco's security advisory states that versions 20.18 and later are unaffected, while the vulnerability appears in CISA's Known Exploited Vulnerabilities catalog. The current EPSS score of 0.0008 indicates low exploitation probability at the time of reporting.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8676
Vulnerability Data
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file…
more
for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.
- CWE(s)
- KEV Date Added
- See CISA KEV catalog
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V11.4.2V11.4.4
Mitigating Controls (NIST 800-53 r5) AI
IA-5 requires proper management of authenticators including storage of passwords only in non-recoverable (hashed) form, directly stopping the weakness from existing.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires secure handling and protection of authentication information, preventing storage in recoverable formats.
Mandates secure authentication mechanisms that preclude recoverable password storage.
Requires proper use of cryptography, which can mitigate recoverable storage if applied correctly to passwords.
Secure SDLC includes requirements that reduce the likelihood of introducing recoverable password storage.
Secure coding practices can prevent developers from implementing recoverable password storage.