CVE-2026-20133
Published: 25 February 2026
Summary
CVE-2026-20133 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Cisco Catalyst Sd-Wan Manager. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Services File Permissions Weakness (T1574.010); ranked in the top 19.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for file system access, directly addressing insufficient restrictions that allow netadmin users via vshell to read sensitive OS information.
Applies least privilege to limit netadmin access, preventing exploitation of vshell to reach sensitive files beyond necessary tasks.
Requires secure configuration settings for file systems in the most restrictive mode consistent with operations, mitigating inadequate restrictions on sensitive data access.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability stems from insufficient file system restrictions (T1044), exploited via vshell (T1059.008, Network Device CLI) to read sensitive information from the local OS file system (T1005).
NVD Description
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability…
more
by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.
Deeper analysisAI
CVE-2026-20133 is a vulnerability in Cisco Catalyst SD-WAN Software stemming from insufficient file system restrictions. This issue affects the software running on impacted systems, potentially exposing sensitive information stored on the underlying operating system.
An authenticated attacker with netadmin privileges can exploit the vulnerability by accessing the vshell on an affected system. Successful exploitation allows the attacker to read sensitive information, with a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflecting network accessibility, low privilege requirements, and high confidentiality impact (CWE-200: Exposure of Sensitive Information).
The Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v details mitigation steps and patches. It is also listed in CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20133, indicating real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 20 April 2026