{"history":[{"alert":0,"cve":"CVE-2026-20128","id":23205,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.08349, \"percentile\": 0.95033}"},{"alert":0,"cve":"CVE-2026-20128","id":20684,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.08349, \"percentile\": 0.95001}"},{"alert":0,"cve":"CVE-2026-20128","id":18684,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.08349, \"percentile\": 0.94994}"},{"alert":0,"cve":"CVE-2026-20128","id":16755,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.08349, \"percentile\": 0.94992}"},{"alert":0,"cve":"CVE-2026-20128","id":14733,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.08349, \"percentile\": 0.94989}"},{"alert":0,"cve":"CVE-2026-20128","id":12517,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.08349, \"percentile\": 0.94981}"},{"alert":0,"cve":"CVE-2026-20128","id":10501,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.08349, \"percentile\": 0.94977}"},{"alert":0,"cve":"CVE-2026-20128","id":8051,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.08349, \"percentile\": 0.94972}"},{"alert":0,"cve":"CVE-2026-20128","id":5830,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.07317, \"percentile\": 0.9439}"},{"alert":1,"cve":"CVE-2026-20128","id":3908,"kind":"cna","observed_at":1793701200,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-20128\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-02-25T00:00:00+00:00\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2026-04-20\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-04-21T03:55:31.648Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-20T00:00:00.000Z\", \"value\": \"CVE-2026-20128 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unknown\", \"product\": \"Cisco Catalyst SD-WAN Manager\", \"vendor\": \"Cisco\", \"versions\": [{\"status\": \"affected\", \"version\": \"20.1.12\"}, {\"status\": \"affected\", \"version\": \"19.2.1\"}, {\"status\": \"affected\", \"version\": \"18.4.4\"}, {\"status\": \"affected\", \"version\": \"18.4.5\"}, {\"status\": \"affected\", \"version\": \"20.1.1.1\"}, {\"status\": \"affected\", \"version\": \"20.1.1\"}, {\"status\": \"affected\", \"version\": \"19.3.0\"}, {\"status\": \"affected\", \"version\": \"19.2.2\"}, {\"status\": \"affected\", \"version\": \"19.2.099\"}, {\"status\": \"affected\", \"version\": \"18.3.6\"}, {\"status\": \"affected\", \"version\": \"18.3.7\"}, {\"status\": \"affected\", \"version\": \"19.2.0\"}, {\"status\": \"affected\", \"version\": \"18.3.8\"}, {\"status\": \"affected\", \"version\": \"19.0.0\"}, {\"status\": \"affected\", \"version\": \"19.1.0\"}, {\"status\": \"affected\", \"version\": \"18.4.302\"}, {\"status\": \"affected\", \"version\": \"18.4.303\"}, {\"status\": \"affected\", \"version\": \"19.2.097\"}, {\"status\": \"affected\", \"version\": \"19.2.098\"}, {\"status\": \"affected\", \"version\": \"17.2.10\"}, {\"status\": \"affected\", \"version\": \"18.3.6.1\"}, {\"status\": \"affected\", \"version\": \"19.0.1a\"}, {\"status\": \"affected\", \"version\": \"18.2.0\"}, {\"status\": \"affected\", \"version\": \"18.4.3\"}, {\"status\": \"affected\", \"version\": \"18.4.1\"}, {\"status\": \"affected\", \"version\": \"17.2.8\"}, {\"status\": \"affected\", \"version\": \"18.3.3.1\"}, {\"status\": \"affected\", \"version\": \"18.4.0\"}, {\"status\": \"affected\", \"version\": \"18.3.1\"}, {\"status\": \"affected\", \"version\": \"17.2.6\"}, {\"status\": \"affected\", \"version\": \"17.2.9\"}, {\"status\": \"affected\", \"version\": \"18.3.4\"}, {\"status\": \"affected\", \"version\": \"17.2.5\"}, {\"status\": \"affected\", \"version\": \"18.3.1.1\"}, {\"status\": \"affected\", \"version\": \"18.3.5\"}, {\"status\": \"affected\", \"version\": \"18.4.0.1\"}, {\"status\": \"affected\", \"version\": \"18.3.3\"}, {\"status\": \"affected\", \"version\": \"17.2.7\"}, {\"status\": \"affected\", \"version\": \"18.3.0\"}, {\"status\": \"affected\", \"version\": \"19.2.3\"}, {\"status\": \"affected\", \"version\": \"18.4.501_ES\"}, {\"status\": \"affected\", \"version\": \"20.3.1\"}, {\"status\": \"affected\", \"version\": \"20.1.2\"}, {\"status\": \"affected\", \"version\": \"19.2.929\"}, {\"status\": \"affected\", \"version\": \"19.2.31\"}, {\"status\": \"affected\", \"version\": \"20.3.2\"}, {\"status\": \"affected\", \"version\": \"19.2.32\"}, {\"status\": \"affected\", \"version\": \"20.3.2.1\"}, {\"status\": \"affected\", \"version\": \"20.3.2.1_927\"}, {\"status\": \"affected\", \"version\": \"18.4.6\"}, {\"status\": \"affected\", \"version\": \"20.3.2_928\"}, {\"status\": \"affected\", \"version\": \"20.3.2_929\"}, {\"status\": \"affected\", \"version\": \"20.4.1.0.1\"}, {\"status\": \"affected\", \"version\": \"20.3.2.1_930\"}, {\"status\": \"affected\", \"version\": \"19.2.4\"}, {\"status\": \"affected\", \"version\": \"20.5.0.1.1\"}, {\"status\": \"affected\", \"version\": \"20.4.1.1\"}, {\"status\": \"affected\", \"version\": \"20.3.3\"}, {\"status\": \"affected\", \"version\": \"19.2.4.0.1\"}, {\"status\": \"affected\", \"version\": \"20.3.2_937\"}, {\"status\": \"affected\", \"version\": \"20.5.1\"}, {\"status\": \"affected\", \"version\": \"20.1.3\"}, {\"status\": \"affected\", \"version\": \"20.3.3.0.4\"}, {\"status\": \"affected\", \"version\": \"20.3.3.1.2\"}, {\"status\": \"affected\", \"version\": \"20.3.3.1.1\"}, {\"status\": \"affected\", \"version\": \"20.4.1.2\"}, {\"status\": \"affected\", \"version\": \"20.3.3.0.2\"}, {\"status\": \"affected\", \"version\": \"20.4.1.1.5\"}, {\"status\": \"affected\", \"version\": \"20.4.1.0.02\"}, {\"status\": \"affected\", \"version\": \"20.3.3.1.7\"}, {\"status\": \"affected\", \"version\": \"20.3.3.1.5\"}, {\"status\": \"affected\", \"version\": \"20.5.1.0.1\"}, {\"status\": \"affected\", \"version\": \"20.3.3.1.10\"}, {\"status\": \"affected\", \"version\": \"20.3.3.0.8\"}, {\"status\": \"affected\", \"version\": \"20.4.2\"}, {\"status\": \"affected\", \"version\": \"20.3.4\"}, {\"status\": \"affected\", \"version\": \"20.3.3.0.14\"}, {\"status\": \"affected\", \"version\": \"19.2.4.0.8\"}, {\"status\": \"affected\", \"version\": \"19.2.4.0.9\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.1\"}, {\"status\": \"affected\", \"version\": \"20.3.2.0.5\"}, {\"status\": \"affected\", \"version\": \"20.5.1.0.2\"}, {\"status\": \"affected\", \"version\": \"20.6.1.1\"}, {\"status\": \"affected\", \"version\": \"20.6.0.18.3\"}, {\"status\": \"affected\", \"version\": \"20.3.2.0.6\"}, {\"status\": \"affected\", \"version\": \"20.6.0.18.4\"}, {\"status\": \"affected\", \"version\": \"20.4.2.0.2\"}, {\"status\": \"affected\", \"version\": \"20.3.3.0.16\"}, {\"status\": \"affected\", \"version\": \"20.6.1.0.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.6\"}, {\"status\": \"affected\", \"version\": \"20.7.1EFT2\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.9\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.11\"}, {\"status\": \"affected\", \"version\": \"20.3.3.0.18\"}, {\"status\": \"affected\", \"version\": \"20.6.2.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4.1\"}, {\"status\": \"affected\", \"version\": \"20.4.2.1\"}, {\"status\": \"affected\", \"version\": \"20.4.2.1.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4.1.1\"}, {\"status\": \"affected\", \"version\": \"20.3.813\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.19\"}, {\"status\": \"affected\", \"version\": \"20.4.2.2.1\"}, {\"status\": \"affected\", \"version\": \"20.5.1.2\"}, {\"status\": \"affected\", \"version\": \"20.3.814\"}, {\"status\": \"affected\", \"version\": \"20.4.2.2\"}, {\"status\": \"affected\", \"version\": \"20.6.2.2\"}, {\"status\": \"affected\", \"version\": \"20.3.4.2.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4.1.2\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.20\"}, {\"status\": \"affected\", \"version\": \"20.6.2.2.3\"}, {\"status\": \"affected\", \"version\": \"20.4.2.2.2\"}, {\"status\": \"affected\", \"version\": \"20.6.2.0.4\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.24\"}, {\"status\": \"affected\", \"version\": \"20.6.2.2.7\"}, {\"status\": \"affected\", \"version\": \"20.3.4.2.2\"}, {\"status\": \"affected\", \"version\": \"20.4.2.2.4\"}, {\"status\": \"affected\", \"version\": \"20.3.5.0.8\"}, {\"status\": \"affected\", \"version\": \"20.3.5.0.9\"}, {\"status\": \"affected\", \"version\": \"20.3.5.0.7\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.2\"}, {\"status\": \"affected\", \"version\": \"20.9.1EFT2\"}, {\"status\": \"affected\", \"version\": \"20.3.6\"}, {\"status\": \"affected\", \"version\": \"20.3.7\"}, {\"status\": \"affected\", \"version\": \"20.4.2.3\"}, {\"status\": \"affected\", \"version\": \"20.3.5.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4.3\"}, {\"status\": \"affected\", \"version\": \"20.3.3.2\"}, {\"status\": \"affected\", \"version\": \"20.3.7.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4.0.25\"}, {\"status\": \"affected\", \"version\": \"20.6.2.2.4\"}, {\"status\": \"affected\", \"version\": \"20.6.1.2\"}, {\"status\": \"affected\", \"version\": \"20.1.3.1\"}, {\"status\": \"affected\", \"version\": \"20.6.5.1.4\"}, {\"status\": \"affected\", \"version\": \"20.3.8\"}, {\"status\": \"affected\", \"version\": \"20.12.501\"}, {\"status\": \"affected\", \"version\": \"26.1.1\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system.\\r\\n\\r\\nThis vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges.\\r\\nNote: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in CVE-2026-20133, CVE-2026-20126, and CVE-2026-20129.\\r\\n\\r\\nIn March 2026, the Cisco PSIRT became aware of active exploitation of the vulnerabilities that are described in CVE-2026-20128 and CVE-2026-20122 only. The vulnerabilities that are described in the other CVEs in this advisory are not known to have been compromised. Cisco strongly recommends that customers upgrade to a fixed software release to remediate these vulnerabilities.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"cvssV3_1\"}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-257\", \"description\": \"Storing Passwords in a Recoverable Format\", \"lang\": \"en\", \"type\": \"cwe\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-03-20T21:47:33.415Z\", \"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\"}, \"references\": [{\"name\": \"cisco-sa-sdwan-authbp-qwCX8D4v\", \"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v\"}], \"source\": {\"advisory\": \"cisco-sa-sdwan-authbp-qwCX8D4v\", \"defects\": [\"CSCws33585\"], \"discovery\": \"INTERNAL\"}, \"title\": \"Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability\"}}, \"cveMetadata\": {\"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"assignerShortName\": \"cisco\", \"cveId\": \"CVE-2026-20128\", \"datePublished\": \"2026-02-25T16:14:12.353Z\", \"dateReserved\": \"2025-10-08T11:59:15.379Z\", \"dateUpdated\": \"2026-04-21T03:55:31.648Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":0,"cve":"CVE-2026-20128","id":3506,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.07317, \"percentile\": 0.94382}"},{"alert":1,"cve":"CVE-2026-20128","id":195,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2026-20128\", \"cwes\": [\"CWE-257\"], \"dateAdded\": \"2026-04-20\", \"dueDate\": \"2026-04-23\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ; https://nvd.nist.gov/vuln/detail/CVE-2026-20128\", \"product\": \"Catalyst SD-WAN Manager\", \"requiredAction\": \"Please adhere to CISA\\u2019s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA\\u2019s Emergency Directive 26-03 (URL listed below in Notes) and CISA\\u2019s \\u201cHunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.\", \"shortDescription\": \"Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.\", \"vendorProject\": \"Cisco\", \"vulnerabilityName\": \"Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability\"}"}],"record":{"affected":[{"defaultStatus":"unknown","product":"Cisco Catalyst SD-WAN Manager","vendor":"Cisco","versions":[{"status":"affected","version":"20.1.12"},{"status":"affected","version":"19.2.1"},{"status":"affected","version":"18.4.4"},{"status":"affected","version":"18.4.5"},{"status":"affected","version":"20.1.1.1"},{"status":"affected","version":"20.1.1"},{"status":"affected","version":"19.3.0"},{"status":"affected","version":"19.2.2"},{"status":"affected","version":"19.2.099"},{"status":"affected","version":"18.3.6"},{"status":"affected","version":"18.3.7"},{"status":"affected","version":"19.2.0"},{"status":"affected","version":"18.3.8"},{"status":"affected","version":"19.0.0"},{"status":"affected","version":"19.1.0"},{"status":"affected","version":"18.4.302"},{"status":"affected","version":"18.4.303"},{"status":"affected","version":"19.2.097"},{"status":"affected","version":"19.2.098"},{"status":"affected","version":"17.2.10"},{"status":"affected","version":"18.3.6.1"},{"status":"affected","version":"19.0.1a"},{"status":"affected","version":"18.2.0"},{"status":"affected","version":"18.4.3"},{"status":"affected","version":"18.4.1"},{"status":"affected","version":"17.2.8"},{"status":"affected","version":"18.3.3.1"},{"status":"affected","version":"18.4.0"},{"status":"affected","version":"18.3.1"},{"status":"affected","version":"17.2.6"},{"status":"affected","version":"17.2.9"},{"status":"affected","version":"18.3.4"},{"status":"affected","version":"17.2.5"},{"status":"affected","version":"18.3.1.1"},{"status":"affected","version":"18.3.5"},{"status":"affected","version":"18.4.0.1"},{"status":"affected","version":"18.3.3"},{"status":"affected","version":"17.2.7"},{"status":"affected","version":"18.3.0"},{"status":"affected","version":"19.2.3"},{"status":"affected","version":"18.4.501_ES"},{"status":"affected","version":"20.3.1"},{"status":"affected","version":"20.1.2"},{"status":"affected","version":"19.2.929"},{"status":"affected","version":"19.2.31"},{"status":"affected","version":"20.3.2"},{"status":"affected","version":"19.2.32"},{"status":"affected","version":"20.3.2.1"},{"status":"affected","version":"20.3.2.1_927"},{"status":"affected","version":"18.4.6"},{"status":"affected","version":"20.3.2_928"},{"status":"affected","version":"20.3.2_929"},{"status":"affected","version":"20.4.1.0.1"},{"status":"affected","version":"20.3.2.1_930"},{"status":"affected","version":"19.2.4"},{"status":"affected","version":"20.5.0.1.1"},{"status":"affected","version":"20.4.1.1"},{"status":"affected","version":"20.3.3"},{"status":"affected","version":"19.2.4.0.1"},{"status":"affected","version":"20.3.2_937"},{"status":"affected","version":"20.5.1"},{"status":"affected","version":"20.1.3"},{"status":"affected","version":"20.3.3.0.4"},{"status":"affected","version":"20.3.3.1.2"},{"status":"affected","version":"20.3.3.1.1"},{"status":"affected","version":"20.4.1.2"},{"status":"affected","version":"20.3.3.0.2"},{"status":"affected","version":"20.4.1.1.5"},{"status":"affected","version":"20.4.1.0.02"},{"status":"affected","version":"20.3.3.1.7"},{"status":"affected","version":"20.3.3.1.5"},{"status":"affected","version":"20.5.1.0.1"},{"status":"affected","version":"20.3.3.1.10"},{"status":"affected","version":"20.3.3.0.8"},{"status":"affected","version":"20.4.2"},{"status":"affected","version":"20.3.4"},{"status":"affected","version":"20.3.3.0.14"},{"status":"affected","version":"19.2.4.0.8"},{"status":"affected","version":"19.2.4.0.9"},{"status":"affected","version":"20.3.4.0.1"},{"status":"affected","version":"20.3.2.0.5"},{"status":"affected","version":"20.5.1.0.2"},{"status":"affected","version":"20.6.1.1"},{"status":"affected","version":"20.6.0.18.3"},{"status":"affected","version":"20.3.2.0.6"},{"status":"affected","version":"20.6.0.18.4"},{"status":"affected","version":"20.4.2.0.2"},{"status":"affected","version":"20.3.3.0.16"},{"status":"affected","version":"20.6.1.0.1"},{"status":"affected","version":"20.3.4.0.6"},{"status":"affected","version":"20.7.1EFT2"},{"status":"affected","version":"20.3.4.0.9"},{"status":"affected","version":"20.3.4.0.11"},{"status":"affected","version":"20.3.3.0.18"},{"status":"affected","version":"20.6.2.1"},{"status":"affected","version":"20.3.4.1"},{"status":"affected","version":"20.4.2.1"},{"status":"affected","version":"20.4.2.1.1"},{"status":"affected","version":"20.3.4.1.1"},{"status":"affected","version":"20.3.813"},{"status":"affected","version":"20.3.4.0.19"},{"status":"affected","version":"20.4.2.2.1"},{"status":"affected","version":"20.5.1.2"},{"status":"affected","version":"20.3.814"},{"status":"affected","version":"20.4.2.2"},{"status":"affected","version":"20.6.2.2"},{"status":"affected","version":"20.3.4.2.1"},{"status":"affected","version":"20.3.4.1.2"},{"status":"affected","version":"20.3.4.0.20"},{"status":"affected","version":"20.6.2.2.3"},{"status":"affected","version":"20.4.2.2.2"},{"status":"affected","version":"20.6.2.0.4"},{"status":"affected","version":"20.3.4.0.24"},{"status":"affected","version":"20.6.2.2.7"},{"status":"affected","version":"20.3.4.2.2"},{"status":"affected","version":"20.4.2.2.4"},{"status":"affected","version":"20.3.5.0.8"},{"status":"affected","version":"20.3.5.0.9"},{"status":"affected","version":"20.3.5.0.7"},{"status":"affected","version":"20.6.3.0.2"},{"status":"affected","version":"20.9.1EFT2"},{"status":"affected","version":"20.3.6"},{"status":"affected","version":"20.3.7"},{"status":"affected","version":"20.4.2.3"},{"status":"affected","version":"20.3.5.1"},{"status":"affected","version":"20.3.4.3"},{"status":"affected","version":"20.3.3.2"},{"status":"affected","version":"20.3.7.1"},{"status":"affected","version":"20.3.4.0.25"},{"status":"affected","version":"20.6.2.2.4"},{"status":"affected","version":"20.6.1.2"},{"status":"affected","version":"20.1.3.1"},{"status":"affected","version":"20.6.5.1.4"},{"status":"affected","version":"20.3.8"},{"status":"affected","version":"20.12.501"},{"status":"affected","version":"26.1.1"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-20128","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-02-25T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-04-20","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-04-21T03:55:31.648Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128"}],"timeline":[{"lang":"en","time":"2026-04-20T00:00:00.000Z","value":"CVE-2026-20128 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","product":"Cisco Catalyst SD-WAN Manager","vendor":"Cisco","versions":[{"status":"affected","version":"20.1.12"},{"status":"affected","version":"19.2.1"},{"status":"affected","version":"18.4.4"},{"status":"affected","version":"18.4.5"},{"status":"affected","version":"20.1.1.1"},{"status":"affected","version":"20.1.1"},{"status":"affected","version":"19.3.0"},{"status":"affected","version":"19.2.2"},{"status":"affected","version":"19.2.099"},{"status":"affected","version":"18.3.6"},{"status":"affected","version":"18.3.7"},{"status":"affected","version":"19.2.0"},{"status":"affected","version":"18.3.8"},{"status":"affected","version":"19.0.0"},{"status":"affected","version":"19.1.0"},{"status":"affected","version":"18.4.302"},{"status":"affected","version":"18.4.303"},{"status":"affected","version":"19.2.097"},{"status":"affected","version":"19.2.098"},{"status":"affected","version":"17.2.10"},{"status":"affected","version":"18.3.6.1"},{"status":"affected","version":"19.0.1a"},{"status":"affected","version":"18.2.0"},{"status":"affected","version":"18.4.3"},{"status":"affected","version":"18.4.1"},{"status":"affected","version":"17.2.8"},{"status":"affected","version":"18.3.3.1"},{"status":"affected","version":"18.4.0"},{"status":"affected","version":"18.3.1"},{"status":"affected","version":"17.2.6"},{"status":"affected","version":"17.2.9"},{"status":"affected","version":"18.3.4"},{"status":"affected","version":"17.2.5"},{"status":"affected","version":"18.3.1.1"},{"status":"affected","version":"18.3.5"},{"status":"affected","version":"18.4.0.1"},{"status":"affected","version":"18.3.3"},{"status":"affected","version":"17.2.7"},{"status":"affected","version":"18.3.0"},{"status":"affected","version":"19.2.3"},{"status":"affected","version":"18.4.501_ES"},{"status":"affected","version":"20.3.1"},{"status":"affected","version":"20.1.2"},{"status":"affected","version":"19.2.929"},{"status":"affected","version":"19.2.31"},{"status":"affected","version":"20.3.2"},{"status":"affected","version":"19.2.32"},{"status":"affected","version":"20.3.2.1"},{"status":"affected","version":"20.3.2.1_927"},{"status":"affected","version":"18.4.6"},{"status":"affected","version":"20.3.2_928"},{"status":"affected","version":"20.3.2_929"},{"status":"affected","version":"20.4.1.0.1"},{"status":"affected","version":"20.3.2.1_930"},{"status":"affected","version":"19.2.4"},{"status":"affected","version":"20.5.0.1.1"},{"status":"affected","version":"20.4.1.1"},{"status":"affected","version":"20.3.3"},{"status":"affected","version":"19.2.4.0.1"},{"status":"affected","version":"20.3.2_937"},{"status":"affected","version":"20.5.1"},{"status":"affected","version":"20.1.3"},{"status":"affected","version":"20.3.3.0.4"},{"status":"affected","version":"20.3.3.1.2"},{"status":"affected","version":"20.3.3.1.1"},{"status":"affected","version":"20.4.1.2"},{"status":"affected","version":"20.3.3.0.2"},{"status":"affected","version":"20.4.1.1.5"},{"status":"affected","version":"20.4.1.0.02"},{"status":"affected","version":"20.3.3.1.7"},{"status":"affected","version":"20.3.3.1.5"},{"status":"affected","version":"20.5.1.0.1"},{"status":"affected","version":"20.3.3.1.10"},{"status":"affected","version":"20.3.3.0.8"},{"status":"affected","version":"20.4.2"},{"status":"affected","version":"20.3.4"},{"status":"affected","version":"20.3.3.0.14"},{"status":"affected","version":"19.2.4.0.8"},{"status":"affected","version":"19.2.4.0.9"},{"status":"affected","version":"20.3.4.0.1"},{"status":"affected","version":"20.3.2.0.5"},{"status":"affected","version":"20.5.1.0.2"},{"status":"affected","version":"20.6.1.1"},{"status":"affected","version":"20.6.0.18.3"},{"status":"affected","version":"20.3.2.0.6"},{"status":"affected","version":"20.6.0.18.4"},{"status":"affected","version":"20.4.2.0.2"},{"status":"affected","version":"20.3.3.0.16"},{"status":"affected","version":"20.6.1.0.1"},{"status":"affected","version":"20.3.4.0.6"},{"status":"affected","version":"20.7.1EFT2"},{"status":"affected","version":"20.3.4.0.9"},{"status":"affected","version":"20.3.4.0.11"},{"status":"affected","version":"20.3.3.0.18"},{"status":"affected","version":"20.6.2.1"},{"status":"affected","version":"20.3.4.1"},{"status":"affected","version":"20.4.2.1"},{"status":"affected","version":"20.4.2.1.1"},{"status":"affected","version":"20.3.4.1.1"},{"status":"affected","version":"20.3.813"},{"status":"affected","version":"20.3.4.0.19"},{"status":"affected","version":"20.4.2.2.1"},{"status":"affected","version":"20.5.1.2"},{"status":"affected","version":"20.3.814"},{"status":"affected","version":"20.4.2.2"},{"status":"affected","version":"20.6.2.2"},{"status":"affected","version":"20.3.4.2.1"},{"status":"affected","version":"20.3.4.1.2"},{"status":"affected","version":"20.3.4.0.20"},{"status":"affected","version":"20.6.2.2.3"},{"status":"affected","version":"20.4.2.2.2"},{"status":"affected","version":"20.6.2.0.4"},{"status":"affected","version":"20.3.4.0.24"},{"status":"affected","version":"20.6.2.2.7"},{"status":"affected","version":"20.3.4.2.2"},{"status":"affected","version":"20.4.2.2.4"},{"status":"affected","version":"20.3.5.0.8"},{"status":"affected","version":"20.3.5.0.9"},{"status":"affected","version":"20.3.5.0.7"},{"status":"affected","version":"20.6.3.0.2"},{"status":"affected","version":"20.9.1EFT2"},{"status":"affected","version":"20.3.6"},{"status":"affected","version":"20.3.7"},{"status":"affected","version":"20.4.2.3"},{"status":"affected","version":"20.3.5.1"},{"status":"affected","version":"20.3.4.3"},{"status":"affected","version":"20.3.3.2"},{"status":"affected","version":"20.3.7.1"},{"status":"affected","version":"20.3.4.0.25"},{"status":"affected","version":"20.6.2.2.4"},{"status":"affected","version":"20.6.1.2"},{"status":"affected","version":"20.1.3.1"},{"status":"affected","version":"20.6.5.1.4"},{"status":"affected","version":"20.3.8"},{"status":"affected","version":"20.12.501"},{"status":"affected","version":"26.1.1"}]}],"descriptions":[{"lang":"en","value":"A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system.\r\n\r\nThis vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges.\r\nNote: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability."}],"exploits":[{"lang":"en","value":"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in CVE-2026-20133, CVE-2026-20126, and CVE-2026-20129.\r\n\r\nIn March 2026, the Cisco PSIRT became aware of active exploitation of the vulnerabilities that are described in CVE-2026-20128 and CVE-2026-20122 only. The vulnerabilities that are described in the other CVEs in this advisory are not known to have been compromised. Cisco strongly recommends that customers upgrade to a fixed software release to remediate these vulnerabilities."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"cvssV3_1"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-257","description":"Storing Passwords in a Recoverable Format","lang":"en","type":"cwe"}]}],"providerMetadata":{"dateUpdated":"2026-03-20T21:47:33.415Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"cisco-sa-sdwan-authbp-qwCX8D4v","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"}],"source":{"advisory":"cisco-sa-sdwan-authbp-qwCX8D4v","defects":["CSCws33585"],"discovery":"INTERNAL"},"title":"Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability"}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2026-20128","datePublished":"2026-02-25T16:14:12.353Z","dateReserved":"2025-10-08T11:59:15.379Z","dateUpdated":"2026-04-21T03:55:31.648Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794133200,"cve":"CVE-2026-20128","description":"A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system.\r\n\r\nThis vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges.\r\nNote: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.","epss":{"date":"2026-11-12","epss":0.08349,"percentile":0.95033},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2026-20128","cwes":["CWE-257"],"dateAdded":"2026-04-20","dueDate":"2026-04-23","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ; https://nvd.nist.gov/vuln/detail/CVE-2026-20128","product":"Catalyst SD-WAN Manager","requiredAction":"Please adhere to CISA\u2019s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA\u2019s Emergency Directive 26-03 (URL listed below in Notes) and CISA\u2019s \u201cHunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","shortDescription":"Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.","vendorProject":"Cisco","vulnerabilityName":"Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability"},"kev_checked":1794522003,"products":"Cisco Cisco Catalyst SD-WAN Manager","references":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128"],"score":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","provider":"cisco","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}