Cyber Resilience

CVE-2026-20224

HighUpdated

Published: 14 May 2026

Published
14 May 2026
Modified
29 June 2026
KEV Added
Patch
CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS Score 0.0070 48.4th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-20224 is a high-severity Improper Input Validation (CWE-20) vulnerability in Cisco Catalyst Sd-Wan Manager. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in an affected system. The attacker does not need to have valid user…

more

credentials. This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to read arbitrary files that are stored in the affected system.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Why these techniques?

XXE in public web UI enables remote unauthenticated file read (T1190 + T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-29814Shared CWE-20
CVE-2026-21864Shared CWE-20
CVE-2026-22862Shared CWE-20
CVE-2025-1022Shared CWE-20
CVE-2025-48913Shared CWE-20
CVE-2026-8000Shared CWE-20
CVE-2025-59028Shared CWE-20
CVE-2025-67484Shared CWE-20
CVE-2025-1026Shared CWE-20
CVE-2026-7905Shared CWE-20

Affected Assets

cisco
catalyst sd-wan manager
20.12.7 · ≤ 20.9.9.1 · 20.10 — 20.12.5.4 · 20.12.6 — 20.12.6.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-20

Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.

addresses: CWE-20

Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.

addresses: CWE-20

Directly implements checks on information inputs to reject invalid data before processing.

addresses: CWE-20

Spam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.

References