Home › Exploited CVEs › CVE-2026-20128

CVE-2026-20128: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

Cisco Catalyst SD-WAN Manager · in CISA KEV since 2026-04-20

2026-04-20added to KEV

2026-04-23federal remediation due date

7.66%EPSS exploit probability (30 days) 94.3th percentile

7.5 HIGHCVSS 3.1

Unknownknown ransomware use

54days from NVD publication to KEV

What it is

Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.

Required action (CISA)

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

CWE	CWE-257
CVSS vector	`CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H`
NVD published	2026-02-25 (Analyzed)

Original records: NVD · CISA KEV · JSON: /api/cve/CVE-2026-20128.json · all KEV CVEs

Kevscope: daily CISA KEV + EPSS datasetThe whole KEV catalog joined with daily EPSS and CVSS scores as CSV/Parquet, refreshed daily. Free to download.
Get the full file: Exploited Vulnerabilities Brief – September 2026 ($29): this month's KEV additions ranked by EPSS, ransomware use and due date, ready to hand to a patch team. Checkout by Polar.