CVE-2026-20129
Description
A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected system as a user who has the netadmin role. The vulnerability is due to improper authentication for requests that are sent to the API. An attacker could exploit this vulnerability by sending a crafted request to the API of an affected system. A successful exploit could allow the attacker to execute commands with the privileges of the netadmin role. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.
How to fix
- cisco catalyst_sd-wan_manager20.9.8.2, 20.12.5.3, 20.15.4.2, 20.18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco catalyst_sd-wan_manager | v < 20.9.8.2, 20.11 ≤ v < 20.12.5.3, 20.13 ≤ v < 20.15.4.2, 20.16 ≤ v < 20.18, 20.12.6 | 20.9.8.2, 20.12.5.3, 20.15.4.2, 20.18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.