CVE · Exploited · On CISA KEV

CVE-2026-20133

Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

7.5: CVSS 3.1
1: story
APR 20: added to KEV

Severity: 7.5 High · NVD score
Vendor: Cisco
Product: Catalyst SD-WAN Manager
Published: Feb 25, 2026
Added to KEV: Apr 20, 2026
KEV deadline: Apr 23, 2026
Ransomware use: Unknown
Weakness: CWE-200

What it is

Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

APR 22
IntrusionsCisco CVE-2026-20133 Targeted in Active AttacksThe three newly added bugs are CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133, the last of which had not been identified in active attacks before.DENNIS FISHER · 2 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorysec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v