CVE · Exploited · On CISA KEV

CVE-2026-20128

Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

7.5: CVSS 3.1
1: story
APR 20: added to KEV

Severity: 7.5 High · vendor score
Vendor: Cisco
Product: Catalyst SD-WAN Manager
Published: Feb 25, 2026
Added to KEV: Apr 20, 2026
KEV deadline: Apr 23, 2026
Ransomware use: Unknown
Weakness: CWE-257

What it is

Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

APR 22
IntrusionsCisco CVE-2026-20133 Targeted in Active AttacksThe three newly added bugs are CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133, the last of which had not been identified in active attacks before.DENNIS FISHER · 2 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorysec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v