CVE-2026-20128
Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
Description
CVE-2026-20128 is a credential exposure vulnerability in Cisco Catalyst SD-WAN Manager (formerly vManage) affecting versions prior to the patched release, where an authenticated local attacker with low-privileged operating system access can read a credential file stored in recoverable format on the filesystem and obtain the password for the DCA (Data Center Automation) user account. The DCA user is an internal service account used by SD-WAN Manager for infrastructure automation tasks, and its compromise allows privilege escalation within the SD-WAN management plane. In enterprise environments, Cisco Catalyst SD-WAN Manager serves as the centralized orchestration and policy management hub for potentially thousands of SD-WAN edge devices, making any privileged compromise of this system catastrophic in terms of network-wide lateral movement potential. CISA added this CVE to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-20, with a remediation due date of 2026-04-23 under Emergency Directive 26-03 — one of the shortest KEV deadlines ever issued, signaling confirmed active exploitation against federal networks. The EPSS score is 0.00053 (16.6th percentile), which is low and may appear contradictory to the KEV listing, but underscores that EPSS is a predictive model based on historical patterns whereas KEV reflects observed real-world exploitation. This CVE is part of a cluster of SD-WAN Manager vulnerabilities — alongside CVE-2026-20122 and CVE-2026-20133 — all addressed under Emergency Directive 26-03.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | catalyst sd-wan manager | < 20.9.8.2; >= 20.10, < 20.12.5.3; >= 20.13, < 20.15.4.2; >= 20.16, < 20.18; 20.12.6 |
References
Weakness Type
CWE-257: Storing Passwords in a Recoverable Format
CWE-257 describes the practice of storing passwords or secrets in a format from which the original plaintext value can be recovered — either because the value is stored in cleartext, using reversible encoding such as Base64, or encrypted with a key that is itself accessible to the same attacker. In the case of CVE-2026-20128, Cisco Catalyst SD-WAN Manager stores the DCA user's credentials in a file on the local filesystem in a format that a low-privileged OS user can read and from which the password can be extracted or directly reused. This is categorically different from a one-way hashing failure (CWE-916) — here the design choice was to make the credential recoverable, presumably for programmatic reuse by the SD-WAN Manager software itself, but the file permissions or encryption model were insufficient to prevent unauthorized access.
The broader security risk of CWE-257 in infrastructure software is that service account credentials stored this way become persistent, high-value targets. Once an attacker gains any foothold on the host system — through a separate vulnerability, a misconfigured SSH key, or supply chain compromise — they can trivially harvest these credentials without triggering any authentication event. In SD-WAN infrastructure, where the DCA account may have automation privileges across the management plane, this means a local low-privilege shell can pivot to network-wide control. The pattern of storing recoverable credentials in configuration or state files is endemic to networking equipment and management platforms and has been a recurring source of critical privilege escalation vulnerabilities.
Learn more: CWE-257 — Storing Passwords in a Recoverable Format
Impact Analysis
The attack vector for CVE-2026-20128 is Local, requiring the attacker to already have an authenticated session on the Cisco Catalyst SD-WAN Manager host operating system. Attack Complexity is Low once local access is established — the credential file is readable without any additional exploitation steps beyond navigating to the filesystem path and reading its contents. Privileges Required is Low, meaning the attacker need not already be root or an administrator to read the credential file; a low-privileged user account or service account compromise is sufficient. User Interaction is None — no administrator or other user action is needed to trigger or facilitate the read operation. The scope of the impact changes, as the DCA user account operates with elevated privileges within the SD-WAN Manager application, so a local low-privilege OS compromise escalates to application-level privileged access.
In terms of CIA impact: Confidentiality is High, as the DCA credential gives access to sensitive configuration data, network topology information, and authentication material for managed edge devices. Integrity is High, as a privileged DCA user can modify SD-WAN policies, routing configurations, and device templates across the managed SD-WAN fabric. Availability impact is also High given the potential to disrupt or reconfigure the entire SD-WAN overlay. Despite the Local attack vector limiting initial exploitation, the combination of KEV listing with an Emergency Directive due date of 2026-04-23 (72-hour window) makes this a P0 remediation priority for any organization running Cisco Catalyst SD-WAN Manager — federal agencies under FISMA are legally required to comply, but the threat intelligence context makes this equally urgent for all critical infrastructure operators.
Exploit Maturity
CVE-2026-20128 is confirmed as actively exploited in the wild, as evidenced by its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-04-20 and its inclusion in Emergency Directive 26-03 with a 72-hour remediation deadline of 2026-04-23 — one of the most aggressive timelines CISA has ever mandated, reserved for vulnerabilities with confirmed exploitation against federal infrastructure. Emergency Directives are issued only when CISA has specific intelligence that a vulnerability poses an unacceptable risk to federal civilian networks, indicating this is not a theoretical exploit but an observed active threat.
The EPSS score of 0.00053 places this CVE in only the 16.6th percentile for exploitation probability — a seemingly low score that is explained by the nature of the vulnerability: local access requirements and a niche product mean fewer opportunistic exploit attempts are captured in the telemetry that informs EPSS models. However, nation-state and sophisticated threat actors targeting SD-WAN infrastructure for network visibility and lateral movement do not show up prominently in EPSS signals. The combination of KEV listing plus Emergency Directive with a highly compressed deadline is the strongest possible signal of active, high-priority exploitation regardless of EPSS score.
No public ransomware campaigns have been specifically attributed to this CVE at time of publication. However, the SD-WAN management plane access it enables would be a high-value target for espionage actors seeking persistent network access, and any subsequent ransomware operators using the same infrastructure access chain would be able to leverage SD-WAN visibility for extensive network mapping prior to encryption payload deployment.
Remediation
-
CISA Emergency Directive 26-03 Compliance: Federal civilian executive branch (FCEB) agencies must remediate by 2026-04-23 per ED 26-03. All organizations should treat this as an emergency priority given active exploitation. Review CISA's ED 26-03 for specific reporting and attestation requirements.
-
Apply Cisco Security Patch: Upgrade Cisco Catalyst SD-WAN Manager to the fixed version specified in Cisco Security Advisory cisco-sa-sdwan-credfile-2026-20128. Verify the installed version via the SD-WAN Manager web UI under Administration > Software Repository or via CLI:
show version. Do not delay patching pending change window approvals — invoke emergency change procedures. -
Interim Mitigations: Until patching is complete, restrict SSH and console access to the SD-WAN Manager host to only named administrators via jump host or privileged access workstation (PAW). Remove or disable any non-essential local OS user accounts on the SD-WAN Manager appliance. Audit current local user accounts:
cat /etc/passwdand review sudoers configuration. -
Network Access Controls: Enforce network segmentation so that the SD-WAN Manager management interface (vManage port 443 and SSH port 22) is only accessible from dedicated management VLANs or out-of-band management networks. Block all direct internet exposure of the SD-WAN Manager. Verify ACLs on management interfaces and confirm no public-facing exposure via firewall rule audit.
-
Detection and Hunting: Review OS-level audit logs for access to the DCA credential file path (check Cisco advisory for specific path). Search SIEM for authentication events using the DCA username from unexpected source IPs or during off-hours. Enable auditd rules on the SD-WAN Manager host to alert on reads of sensitive credential files going forward:
auditctl -w /path/to/cred/file -p r -k dca_cred_read. -
Defense-in-Depth Against CWE-257: Conduct a broader audit of all credential files on SD-WAN Manager and related Cisco infrastructure appliances. Implement a secrets management solution (HashiCorp Vault, CyberArk) for service account credentials wherever operationally feasible. Enforce filesystem permissions such that no service credential file is readable by accounts other than the owning service process. Apply principle of least privilege to all OS-level user accounts on network management appliances.
Technical Details
CVE-2026-20128 stems from the Cisco Catalyst SD-WAN Manager's internal credential management for the DCA (Data Center Automation) service account. The DCA account is used internally by vManage for automation operations within the SD-WAN management plane. The vulnerability exists because the credential for this account is persisted to a file on the local filesystem of the vManage appliance in a recoverable format — either plaintext or a reversibly encoded form — and the file access controls are insufficiently restrictive to prevent a low-privileged local OS user from reading the file.
The exploitation path requires an attacker to have already obtained local authenticated access to the SD-WAN Manager host operating system, which could be achieved through a variety of means: a separate OS-level vulnerability, a compromised SSH private key, a phished administrator credential, or lateral movement from another compromised host with management network access. Once local low-privilege access is established, the attacker reads the credential file to extract the DCA password, then authenticates as the DCA user to perform privileged operations within SD-WAN Manager.
This CVE is tracked alongside CVE-2026-20122 (a different SD-WAN Manager vulnerability) and CVE-2026-20133 (a third SD-WAN Manager issue) under Cisco's coordinated advisory response and CISA's Emergency Directive 26-03, suggesting a compound attack chain may exist or that threat actors are actively targeting SD-WAN Manager as a high-value pivot point. The CVSS base score reflects a Medium severity due to the Local attack vector and requirement for pre-existing authenticated access, but the real-world criticality is amplified by the management plane position of SD-WAN Manager.
Cisco's vendor advisory is available at cisco.com under the SD-WAN security advisories section. Affected versions should be confirmed against the advisory's fixed release table, as the fix boundary varies by SD-WAN Manager software train.
Frequently Asked Questions
Is CVE-2026-20128 being actively exploited?
Yes. CISA added CVE-2026-20128 to the Known Exploited Vulnerabilities catalog on 2026-04-20 and issued Emergency Directive 26-03 requiring federal agencies to remediate within 72 hours (by 2026-04-23). Emergency Directives are issued only when CISA has confirmed evidence of exploitation against federal civilian networks. All organizations operating Cisco Catalyst SD-WAN Manager should treat this as an active threat regardless of federal mandate applicability.
What products are affected?
Cisco Catalyst SD-WAN Manager (formerly known as vManage) is affected. The specific affected versions are detailed in Cisco's security advisory (cisco-sa-sdwan-credfile-2026-20128). This CVE is part of a group of three SD-WAN Manager vulnerabilities addressed together under Emergency Directive 26-03, alongside CVE-2026-20122 and CVE-2026-20133.
How do I fix it?
Upgrade Cisco Catalyst SD-WAN Manager to the fixed version specified in Cisco's security advisory. As an interim measure while patching is arranged, restrict local OS access to the SD-WAN Manager appliance to only essential administrators, and monitor for unexpected authentication events using the DCA username. Verify your current version and consult the Cisco fixed release table to identify the appropriate upgrade target for your software train.
How severe is it?
CVE-2026-20128 is rated Medium severity based on its CVSS score, reflecting that local authenticated access is required as a prerequisite. However, the real-world risk is substantially higher: Cisco Catalyst SD-WAN Manager is the centralized control plane for enterprise-wide SD-WAN deployments, and DCA user compromise within it can enable privileged operations affecting all managed network devices. The Emergency Directive with a 72-hour deadline reflects a threat-intelligence-driven assessment that the operational risk far exceeds the CVSS score alone.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.