CVE-2026-20224: 
Cisco SD-WAN Catalyst Manager vulnerability analysis and mitigation

CVE-2026-20224 is an XML External Entity (XXE) Injection vulnerability in the web UI of Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) that allows an unauthenticated, remote attacker to read arbitrary files stored on the affected system without valid user credentials. The vulnerability was disclosed on May 14, 2026, as part of a broader Cisco security advisory covering multiple SD-WAN Manager flaws. It affects all deployment types of Cisco Catalyst SD-WAN Manager across a wide range of versions (from 17.x through 26.x), including On-Prem, Cisco SD-WAN Cloud-Pro, Cisco SD-WAN Cloud (Cisco Managed), and Cisco SD-WAN for Government (FedRAMP). The CVSS v3.1 base score is 8.6 (High/Critical) (Cisco Advisory, GitHub Advisory).

The root cause is improper handling of XML External Entity (XXE) entries when the web UI parses XML input (CWE-20: Improper Input Validation; CWE-611 estimated by Feedly). An unauthenticated remote attacker can send a crafted HTTP request containing a malicious XML payload with external entity references to the SD-WAN Manager web UI. Because the XML parser does not restrict or sanitize external entity declarations, it resolves the attacker-supplied entity references and returns the contents of arbitrary files from the server's filesystem. No authentication, user interaction, or special preconditions are required — the vulnerable endpoint is accessible over the network to any remote host that can reach the web UI. A public Python proof-of-concept exploit script (Cisco Catalyst.py) is available on GitHub (Cisco Advisory, PoC GitHub).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files stored on the Cisco Catalyst SD-WAN Manager system, resulting in a high confidentiality impact with no integrity or availability impact. Sensitive files that could be disclosed include configuration files, credentials, private keys, and other data accessible to the SD-WAN Manager process, potentially enabling further lateral movement or privilege escalation within the SD-WAN fabric. Given that SD-WAN Manager is a central control plane component managing network-wide configurations, file disclosure could expose credentials or tokens that allow an attacker to pivot to other network infrastructure (Cisco Advisory, GitHub Advisory).

1. Reconnaissance: Identify internet-facing Cisco Catalyst SD-WAN Manager instances using tools like Shodan or Censys, searching for the SD-WAN Manager web UI (typically on port 443 or 8443). Confirm the version is in the affected range (prior to fixed releases).
2. Craft malicious XML payload: Construct an XML document containing an external entity declaration that references a target file on the server, for example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root>&xxe;</root>

3. Identify vulnerable endpoint: Locate the web UI endpoint that accepts and parses XML input (e.g., a configuration import or API endpoint). The public PoC script (Cisco Catalyst.py) automates this step.
4. Send crafted request: Submit an unauthenticated HTTP POST request with the malicious XML payload to the identified endpoint, without supplying any authentication credentials.
5. Retrieve file contents: The SD-WAN Manager XML parser resolves the external entity reference and returns the contents of the specified file (e.g., /etc/passwd, configuration files, or credential stores) in the HTTP response.
6. Escalate access: Use disclosed credentials, private keys, or configuration data to pivot to other SD-WAN components or network infrastructure (Cisco Advisory, PoC GitHub).

• Network: Unexpected or anomalous HTTP POST requests to SD-WAN Manager web UI endpoints containing XML payloads with <!DOCTYPE, <!ENTITY, or SYSTEM keywords; outbound connections from the SD-WAN Manager host to unusual external IPs (potential out-of-band XXE data exfiltration).
• Logs: Web server/application access logs showing unauthenticated requests to XML-parsing endpoints with unusually large or structured XML bodies; error messages in application logs related to XML parsing or file access failures for paths not normally accessed.
• File System: Unexpected access timestamps on sensitive files such as /etc/passwd, /etc/shadow, SD-WAN configuration files, or private key files, indicating they were read by the web application process.
• Process: SD-WAN Manager web service process making unexpected file system reads to sensitive directories outside normal operational paths (Cisco Advisory).

Cisco has released fixed software versions and confirms there are no workarounds that fully address this vulnerability. Organizations should upgrade to the following fixed releases as soon as possible: Cisco Catalyst SD-WAN 20.9 → 20.9.9.1; 20.10/20.11 → 20.12.7.1; 20.12 → 20.12.5.4, 20.12.6.2, or 20.12.7.1; 20.13/20.14 → 20.15.5.2; 20.15 → 20.15.4.4 or 20.15.5.2; 20.16 → 20.18.2.2; 20.18 → 20.18.2.2; 26.1 → 26.1.1.1. Releases earlier than 20.9 should migrate to a supported fixed release. As interim hardening measures, Cisco recommends restricting web UI access to trusted hosts/networks using firewall rules, disabling HTTP access to the web UI, and monitoring logs for suspicious XML requests. The cloud-managed release 20.15.506 has already been patched with no user action required (Cisco Advisory).

The vulnerability was reported to Cisco by Khaled Alshaikh and Khalid Alharthi, and Cisco credited them in the advisory (Cisco Advisory). Community discussion on Reddit's r/Cisco highlighted concern about multiple critical CVEs affecting Cisco Catalyst SD-WAN simultaneously. Security media including HelpNetSecurity and News4Hackers covered the broader SD-WAN vulnerability disclosure, noting the context of an actively exploited zero-day (CVE-2026-20182) disclosed in the same timeframe. The Belgium Centre for Cybersecurity (CCB) issued a warning advisory, and Singapore's CSA published an alert (AL-2026-058) regarding the SD-WAN vulnerabilities. Emerging Threats updated its ruleset (v11207, June 4, 2026) to include detection for this vulnerability.