CVE-2026-20128

CVE-2026-20128 is a password-storage flaw (CWE-257, Storing Passwords in a Recoverable Format) in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager, which leaves a credential file containing the DCA user password on affected systems. An unauthenticated, remote attacker can send a crafted HTTP request to read that file and recover the DCA password. With the recovered credentials, the attacker can access another affected system and gain DCA user privileges, enabling chained compromise across SD-WAN management infrastructure. Organizations running Cisco Catalyst SD-WAN Manager releases earlier than 20.18 are affected; releases 20.18 and later are not. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-04-20, indicating exploitation in the wild, with an EPSS 30-day exploitation probability of 6.9% (94th percentile); no public proof-of-concept is known, and CISA has issued Emergency Directive 26-03 and hunt-and-hardening guidance for Cisco SD-WAN devices.

What to do: Upgrade Cisco Catalyst SD-WAN Manager to release 20.18 or later, which is not affected. In the meantime, follow CISA's Emergency Directive 26-03 and the 'Hunt & Hardening Guidance for Cisco SD-WAN Devices' to assess exposure, hunt for crafted HTTP requests reading the DCA credential file, and rotate DCA credentials on affected systems; if you use affected cloud-service offerings and mitigations are unavailable, follow applicable BOD 22-01 guidance or discontinue use.