CVE · Exploited · On CISA KEV

CVE-2026-20122

Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

5.4: CVSS 3.1
1: story
APR 20: added to KEV

Severity: 5.4 Medium · NVD score
Vendor: Cisco
Product: Catalyst SD-WAN Manger
Published: Feb 25, 2026
Added to KEV: Apr 20, 2026
KEV deadline: Apr 23, 2026
Ransomware use: Unknown
Weakness: CWE-648

What it is

Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

APR 22
IntrusionsCisco CVE-2026-20133 Targeted in Active AttacksThe three newly added bugs are CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133, the last of which had not been identified in active attacks before.DENNIS FISHER · 2 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorysec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v