CVE-2026-20129: 
Cisco SD-WAN Catalyst Manager vulnerability analysis and mitigation

CVE-2026-20129 is a critical authentication bypass vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage). It allows an unauthenticated, remote attacker to gain access to an affected system with the privileges of the netadmin role. The vulnerability was discovered internally by Arthur Vidineyev of Cisco's Advanced Security Initiatives Group (ASIG) and publicly disclosed on February 25, 2026. Affected versions include releases from 20.9 through 20.17 (prior to their respective fixed releases); Cisco Catalyst SD-WAN Manager 20.18 and later are not affected. It carries a CVSS v3.1 base score of 9.8 (Critical) (Cisco Advisory).

The root cause is improper authentication (CWE-287) for requests sent to the Cisco Catalyst SD-WAN Manager API. The vulnerability exists because the API does not properly validate or enforce authentication for certain request types, allowing a remote, unauthenticated attacker to craft a specially formed API request that bypasses authentication controls entirely. No user interaction or prior privileges are required, and the attack is conducted entirely over the network. The vulnerability is tracked under Cisco Bug ID CSCws33587 and is part of a broader advisory covering multiple SD-WAN Manager flaws (Cisco Advisory).

Successful exploitation grants an unauthenticated remote attacker the ability to execute commands with netadmin role privileges on the affected Cisco Catalyst SD-WAN Manager system, resulting in high confidentiality, integrity, and availability impact. An attacker with netadmin access can manipulate SD-WAN network configurations, potentially disrupting WAN connectivity across an enterprise, exfiltrating sensitive network topology and credential data, and using the foothold for lateral movement to connected SD-WAN edge devices and other network infrastructure. The scope of impact is significant given that SD-WAN Manager serves as the centralized management plane for enterprise WAN environments (Cisco Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Cisco Catalyst SD-WAN Manager instances using tools like Shodan or Censys, targeting versions between 20.9 and 20.17 (before their respective fixed releases). Look for exposed management API ports (typically HTTPS on port 8443 or 443).
2. Identify vulnerable API endpoint: Probe the SD-WAN Manager API to identify endpoints that are susceptible to authentication bypass. The vulnerability affects API request handling where authentication is not properly enforced.
3. Craft malicious API request: Construct a specially crafted HTTP/HTTPS request to the SD-WAN Manager API that bypasses the authentication mechanism. The request exploits the improper authentication logic (CWE-287) to be processed as if originating from a netadmin role user.
4. Gain netadmin access: Upon successful exploitation, the attacker receives a response granting netadmin role privileges, enabling execution of privileged API commands without valid credentials.
5. Execute privileged commands: Use the netadmin session to enumerate network configurations, modify SD-WAN policies, extract credentials or sensitive data, or chain with other vulnerabilities (e.g., CVE-2026-20122 for arbitrary file overwrite) to achieve deeper system compromise or deploy web shells (Cisco Advisory).

• Logs: Review /var/log/nms/containers/service-proxy/serviceproxy-access.log for unexpected API requests from unknown or untrusted IP addresses, particularly requests to sensitive API endpoints without corresponding legitimate administrator activity.
• Logs: Unusual authentication-related log entries in SD-WAN Manager logs showing successful API access from unexpected source IPs or at unusual times, especially for netadmin-level operations.
• Logs (related CVE-2026-20128): Entries referencing GET /reports/data/opt/data/containers/config/data-collection-agent/.dca from non-administrator IPs in serviceproxy-access.log.
• Logs (related CVE-2026-20122): Entries referencing POST /dataservice/smartLicensing/uploadAck from unexpected IPs; check vmanage-server.log for suspicious filenames being written (e.g., path traversal patterns like ../../../../../../../../../../../var/lib/wildfly/standalone/deployments/cmd.gz.war).
• File System (related CVE-2026-20122): Presence of /cmd.gz/cmd.jsp or similar web shell files not present on a clean installation.
• Logs (web shell activity): Entries in serviceproxy-access.log referencing POST /cmd.gz/cmd.jsp or similar non-standard endpoints.
• Network: Outbound connections from the SD-WAN Manager to unknown external IPs following API access events; API requests using automated tools (e.g., python-requests user-agent) from non-administrator sources (Cisco Advisory).

Cisco has released fixed software versions and confirms there are no workarounds available for CVE-2026-20129. Organizations should upgrade to the following fixed releases as soon as possible:

• 20.9: Upgrade to 20.9.8.2 or later
• 20.10 / 20.11: Migrate to 20.12.6.1
• 20.12: Upgrade to 20.12.5.3 or 20.12.6.1
• 20.13 / 20.14 / 20.15: Upgrade to 20.15.4.2
• 20.16 / 20.18: Upgrade to 20.18.2.1
• Releases earlier than 20.9 should migrate to a supported fixed release.

As interim hardening measures, Cisco recommends restricting SD-WAN Manager API access to known, trusted hosts via firewall rules, disabling HTTP access to the management portal, placing the system behind a filtering device, and monitoring API authentication logs for anomalous activity. Cisco strongly recommends upgrading to a fixed release rather than relying on network controls alone (Cisco Advisory).

The broader Cisco Catalyst SD-WAN Manager advisory (which includes CVE-2026-20129) received significant attention from the security community following Cisco's confirmation of active exploitation of related vulnerabilities in March 2026. Multiple outlets including The Hacker News, GovInfoSecurity, CyberScoop, and CyberSecurityNews covered the active exploitation of the SD-WAN Manager flaws, with headlines noting a "hacker free-for-all" over the SD-WAN vulnerabilities (GovInfoSecurity, The Hacker News). CERT-EU, the Australian Cyber Security Centre, CIS, and the Belgian Centre for Cybersecurity all issued advisories urging immediate patching (CERT-EU, ACSC, CIS). VulnCheck published a technical blog analyzing the SD-WAN Manager vulnerabilities, and Greenbone noted active exploitation against critical infrastructure (VulnCheck).