CVE-2026-20210
Description
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker with read-only permissions to modify configurations and perform unauthorized actions on an affected system. This vulnerability exists because of a failure to redact sensitive information within device configurations and templates. An attacker could exploit this vulnerability by elevating their read-only permissions to those of a high-privileged user. A successful exploit could allow the attacker to access or modify configuration settings within Cisco Catalyst SD-WAN Manager as a high-privileged user.
How to fix
- cisco catalyst_sd-wan_manager20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco catalyst_sd-wan_manager | v < 20.9.9.1, 20.10 ≤ v < 20.12.5.4, 20.12.6 ≤ v < 20.12.6.2, 20.13 ≤ v < 20.15.4.4, 20.15.5 ≤ v < 20.15.5.2, 20.16 ≤ v < 20.18.2.2, 26.1 ≤ v < 26.1.1.1, 20.12.7 | 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.