Risk Letters

Exploited vulnerability

CVE-2026-20128

TLP:CLEAR

Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.

Facts

  • Vendor: Cisco
  • Product: Catalyst SD-WAN Manager
  • CVSS: 7.5
  • EPSS (probability of exploitation within 30 days): 7.3 %
  • On CISA's Known Exploited Vulnerabilities list since: 20 April 2026
  • First known exploitation: 20 April 2026
  • CISA's deadline for US federal agencies: 23 April 2026
  • Weakness: CWE-257
  • First seen by Risk Letters: 20 April 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD