CVE-2026-20128: 
Cisco SD-WAN Catalyst Manager vulnerability analysis and mitigation

CVE-2026-20128 is an information disclosure vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager that allows an unauthenticated, remote attacker to gain DCA user privileges on affected systems. The vulnerability was first published on February 25, 2026, and affects Cisco Catalyst SD-WAN Manager releases prior to 20.18, with specific fixed versions available across the 20.9, 20.12, and 20.15 branches. Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) per the Cisco advisory, though the Feedly intelligence data notes a local-vector score of 7.5 as well (Cisco Advisory, CISA KEV).

The root cause is classified as CWE-257 (Storing Passwords in a Recoverable Format): a credential file for the DCA user is stored on the affected system's filesystem in a readable format without adequate access controls (Cisco Advisory). An attacker exploits this by sending a crafted HTTP GET request to the API endpoint /reports/data/opt/data/containers/config/data-collection-agent/.dca, which returns the DCA password in plaintext. No authentication is required to read this file via the API, making the attack remotely exploitable without any preconditions beyond network access to the SD-WAN Manager interface. The extracted DCA credentials can then be used to authenticate to other affected SD-WAN Manager systems and gain DCA user privileges (Cisco Advisory, CISA KEV).

Successful exploitation allows an unauthenticated remote attacker to read the DCA credential file and obtain the DCA user password, which can then be used to gain DCA user privileges on other Cisco Catalyst SD-WAN Manager systems in the environment. This creates a significant lateral movement risk across SD-WAN infrastructure, as compromised DCA credentials can be reused against multiple interconnected SD-WAN Manager instances. The vulnerability has been observed in combination with other SD-WAN Manager flaws (notably CVE-2026-20122) in chained attack scenarios, enabling attackers to escalate from credential disclosure to arbitrary file overwrite and potentially full system compromise (Cisco Advisory, Tenable Blog).

1. Reconnaissance: Identify internet-facing Cisco Catalyst SD-WAN Manager instances using tools like Shodan or Censys, targeting versions prior to 20.18. Confirm the target is running a vulnerable release (e.g., before 20.9.8.2, 20.12.5.3, or 20.15.4.2).
2. Craft HTTP request: Send an unauthenticated HTTP GET request to the vulnerable API endpoint on the SD-WAN Manager: GET /reports/data/opt/data/containers/config/data-collection-agent/.dca HTTP/1.1
3. Extract DCA credentials: Parse the HTTP response, which returns the DCA user credential file containing the DCA password in a recoverable format.
4. Authenticate to target systems: Use the extracted DCA credentials to authenticate to other Cisco Catalyst SD-WAN Manager systems in the environment, gaining DCA user privileges.
5. Chain with additional vulnerabilities: Optionally chain with CVE-2026-20122 (arbitrary file overwrite) or other SD-WAN Manager flaws to escalate privileges further, deploy web shells (e.g., Behinder), or achieve persistent access (Cisco Advisory, VulnCheck).

• Network: Unexpected HTTP GET requests to /reports/data/opt/data/containers/config/data-collection-agent/.dca from unknown or external IP addresses; requests using automated HTTP clients (e.g., python-requests) to the SD-WAN Manager API.
• Logs: Entries in /var/log/nms/containers/service-proxy/serviceproxy-access.log matching the pattern: "GET /reports/data/opt/data/containers/config/data-collection-agent/.dca HTTP/1.1" 200 — cross-reference the source IP against known administrator addresses to exclude legitimate use. Example log entry: [2026-03-04T18:14:16.057Z] "GET /reports/data/opt/data/containers/config/data-collection-agent/.dca HTTP/1.1" 200 - 0 32 4 - "172.16.1.1" "python-requests/2.31.0"
• File System: Presence of unexpected files such as /cmd.gz/cmd.jsp (web shell artifact associated with chained CVE-2026-20122 exploitation); entries in /var/log/nms/vmanage-server.log referencing suspicious filenames being written to the deployment directory.
• Logs (chained attack): POST requests to /dataservice/smartLicensing/uploadAck from unknown IPs in serviceproxy-access.log; vmanage-server.log entries showing path traversal filenames (e.g., ../../../../../../../../../../../var/lib/wildfly/standalone/deployments/cmd.gz.war) (Cisco Advisory).

Cisco has released fixed software versions and confirms there are no workarounds available. Organizations should upgrade to the following fixed releases based on their current branch: 20.9.8.2 or later (for 20.9.x), 20.12.5.3 or 20.12.6.1 or later (for 20.10–20.12.x), 20.15.4.2 or later (for 20.13–20.15.x), and 20.18.2.1 or later (for 20.16–20.18.x). Releases earlier than 20.9 should migrate to a supported fixed release. As hardening measures, Cisco recommends restricting SD-WAN Manager access to trusted hosts only, placing the system behind a firewall, disabling HTTP for the web UI, and monitoring logs for the IOCs described above. CISA's Emergency Directive ED-26-03 mandates federal agencies remediate this vulnerability and provides additional hunt and hardening guidance (Cisco Advisory, CISA KEV).

Cisco's PSIRT confirmed active exploitation of CVE-2026-20128 and CVE-2026-20122 in March 2026, updating their advisory to include indicators of compromise and strongly urging immediate upgrades (Cisco Advisory). Tenable published detailed FAQ coverage attributing ongoing exploitation to threat actor UAT-8616 and linking the Behinder web shell to post-exploitation activity (Tenable Blog). Security media including BleepingComputer, SecurityWeek, The Register, and Help Net Security covered the active exploitation extensively, with community discussion on Reddit and LinkedIn highlighting the urgency for network administrators (BleepingComputer). Proofpoint published threat intelligence noting a pattern of repeated SD-WAN vulnerability exploitation in 2026, describing it as "more CVEs, same playbook" (Proofpoint). CERT/EU, the Belgian CCB, and Canadian CCCS all issued advisories, reflecting broad international concern (CERT/EU).