CVE-2026-20128

What it actually does

The flaw exposes a recoverable credential file associated with the Data Collection Agent (DCA) user in affected Cisco Catalyst SD-WAN Manager deployments. By sending a crafted HTTP request, an unauthenticated remote attacker can read the file containing the DCA password. With that credential, the attacker may authenticate as the DCA user on another affected system, gaining DCA-level privileges and potentially accessing sensitive SD-WAN management data or functions. Although the supplied CVSS vector suggests high attacker prerequisites, the vendor description indicates remote unauthenticated credential disclosure through HTTP, so exposed management interfaces should be treated as high risk.

Why it matters to the business

Successful exploitation can give an attacker unauthorized access to SD-WAN management infrastructure, which can affect the confidentiality and integrity of network management operations. Because SD-WAN Manager is used to administer network connectivity, compromise can lead to operational disruption, loss of sensitive configuration data, and potential lateral movement across network management planes. This vulnerability is listed in CISA KEV and marked as actively exploited in the wild, with a remediation due date of 2026-04-23, making remediation overdue for organizations subject to KEV-driven timelines. There is no provided indication that it is used in ransomware campaigns, but credential exposure in network management systems remains a high-priority risk.

How an attack unfolds

An attacker identifies an internet-facing or otherwise reachable Cisco Catalyst SD-WAN Manager instance running an affected release. The attacker sends a crafted HTTP request designed to retrieve the credential file that stores the DCA user password. If the file is returned, the attacker extracts the DCA password and attempts to authenticate to another affected SD-WAN Manager or related DCA-accessible component using that credential. Once authenticated as the DCA user, the attacker can access DCA-level capabilities and data, potentially enabling further reconnaissance, privilege expansion, configuration access, or movement within the SD-WAN management environment. Because exploitation is reported in the wild and the issue is in KEV, defenders should assume exposed affected systems may have been targeted.

How to fix it

Upgrade Cisco Catalyst SD-WAN Manager to a non-affected release. Cisco states that releases 20.18 and later are not affected, so affected deployments should be upgraded to 20.18 or a later Cisco-recommended fixed release. If immediate upgrade is not possible, restrict access to SD-WAN Manager management interfaces to trusted administrative networks, enforce network-layer access controls, monitor and block suspicious HTTP requests to management endpoints, and rotate DCA-related credentials after patching. Because the vulnerability exposes stored credentials, remediation should include credential rotation and review of any systems where the exposed DCA password could have been reused. Remove direct internet exposure for management interfaces wherever possible.

How to confirm the fix worked

Confirm the deployed Cisco Catalyst SD-WAN Manager version is 20.18 or later, or otherwise verified by Cisco as not affected. Validate that management interfaces are not publicly reachable and are limited to trusted administrative sources. Review Cisco advisories and device software inventory to ensure all affected instances are upgraded consistently. After upgrading, rotate the DCA credential and verify that the old credential no longer authenticates. Where safe and authorized, perform a controlled assessment to confirm that the previously exposed credential file cannot be retrieved via HTTP. Confirm logging is enabled for management HTTP access, authentication events, and DCA user activity.

Typical attack path

1. Scan for reachable Cisco Catalyst SD-WAN Manager management interfaces.
2. Fingerprint the instance to determine whether it is running an affected release prior to 20.18.
3. Send a crafted HTTP request intended to read the DCA credential file.
4. Extract the DCA user password from the exposed file contents.
5. Use the recovered DCA credential to authenticate to another affected system or DCA-accessible management function.
6. Perform reconnaissance, collect configuration or telemetry data, and attempt additional access within the SD-WAN management plane.

How to detect it

To determine whether exploitation already occurred, review Cisco Catalyst SD-WAN Manager management-plane HTTP access logs, reverse proxy logs, firewall logs, VPN logs, and authentication/audit logs. Look for unauthenticated HTTP requests that attempted to access unexpected local files, credential-related resources, DCA-related paths, or endpoints returning unusually small sensitive text responses. Correlate suspicious HTTP requests with subsequent DCA user authentication events, especially from unfamiliar IP addresses, external networks, unusual geographies, or hosts that do not normally administer SD-WAN infrastructure. Review successful and failed DCA user logins, privilege use, API calls, configuration reads, telemetry access, and connections to other SD-WAN Manager systems after suspicious HTTP activity. Because exact public exploit paths and file names are not provided in the input, detection should focus on behavioral patterns: credential file reads over HTTP, DCA account use from abnormal sources, and management access immediately following suspicious unauthenticated requests. Preserve logs and collect forensic artifacts from affected appliances if suspicious DCA authentication or anomalous management activity is identified.

• CVE-2026-20128
• DCA user
• Data Collection Agent
• DCA password
• dca

What your security team should do

• Treat this as urgent because it is in CISA KEV, actively exploited in the wild, and the KEV remediation deadline has passed.
• Inventory all Cisco Catalyst SD-WAN Manager instances and identify any releases earlier than 20.18.
• Upgrade affected systems to Cisco Catalyst SD-WAN Manager 20.18 or later, or the latest Cisco-recommended fixed release.
• Immediately restrict management-plane access to trusted administrative networks and remove public internet exposure.
• Rotate DCA-related credentials after patching and check for credential reuse across related systems.
• Review historical HTTP access logs for suspicious file-retrieval attempts against SD-WAN Manager management endpoints.
• Review authentication logs for successful or failed DCA user logins from unusual sources.
• Investigate any unexpected DCA user activity, configuration access, telemetry access, or access from external IP addresses.
• Preserve relevant logs before upgrade or system rebuild if compromise is suspected.
• Monitor Cisco and CISA guidance for updated indicators, affected release details, and exploitation reporting.