CVE-2026-20128: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.
Overview
Cisco Catalyst SD-WAN Manager stores the Data Collection Agent (DCA) user password in a recoverable format on the filesystem, allowing an attacker who obtains that credential file to authenticate to other SD-WAN Manager instances as the DCA user. The flaw affects specific releases prior to 20.18. Exploitation paths described in available sources conflict: one characterizes it as requiring authenticated local access, while another describes exploitation via a crafted HTTP request without authentication. Both paths lead to the same outcome: recovery of the DCA credential and lateral movement to other affected systems.
Vulnerability details
CWE-257 describes a condition where credentials are stored in a format from which the original secret can be recovered, whether plaintext, weakly encoded, or reversibly encrypted. In Cisco Catalyst SD-WAN Manager, a credential file for the DCA user resides on the system filesystem in such a format. Any attacker who can read that file obtains a working password, bypassing any authentication controls that would otherwise protect the DCA account. The weakness is in storage, not in the authentication mechanism itself, meaning the credential is exposed regardless of how strong the DCA account's password policy is.
Available source descriptions present two exploitation paths that are not fully reconciled. One path, consistent with the CVSS vector, requires an authenticated attacker with local access to read the credential file directly from the filesystem as a low-privileged user. A second path described in the NVD advisory states that a crafted HTTP request sent to the affected system can return the file contents to a remote attacker; the CVSS vector, which scores this as local and high-privilege, directly contradicts that characterization. In either case, a successful exploit yields the DCA user password, which the attacker can then use to authenticate to a separate Cisco Catalyst SD-WAN Manager instance and operate with DCA user privileges on that system.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Audit filesystem access logs on SD-WAN Manager hosts for reads of the DCA credential file by any process or user account other than the DCA service itself, particularly from interactive shell sessions or low-privileged user contexts.
- Monitor authentication events on SD-WAN Manager instances for DCA user logins originating from hosts that are not the expected DCA service source, which may indicate credential reuse after recovery from another system.
Remediation
Additional hardening
- Upgrade Cisco Catalyst SD-WAN Manager to release 20.18 or later, which Cisco confirms is not affected by this vulnerability. See the vendor advisory in References for the full fixed-software table.
- Restrict network access to the SD-WAN Manager management interface and API to trusted administrative hosts only, reducing exposure to any HTTP-based exploitation path.
- Apply the assessment and hardening steps described in CISA Emergency Directive 26-03 and the accompanying Hunt and Hardening Guidance for Cisco SD-WAN Devices, both listed in References.
- Audit local user accounts on SD-WAN Manager systems and enforce least-privilege access, limiting the number of accounts that can reach the filesystem paths where credential files reside.
Key dates
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v
- https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems
- https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems
- https://nvd.nist.gov/vuln/detail/CVE-2026-20128
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20128
Frequently asked questions
Does CVE-2026-20128 affect my FedRAMP authorization?
If Cisco Catalyst SD-WAN Manager runs inside your authorization boundary, yes. CVE-2026-20128 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of April 23, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your options are to remediate it immediately or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-20128?
Knox does not patch your software. Remediating Cisco Catalyst SD-WAN Manager is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with Knox's automated continuous monitoring platform and audit-artifact coverage that support documentation of the fix for your next assessment. Applying the patch is yours to own; maintaining a defensible compliance posture while you do it is not something you have to manage alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. When something like CVE-2026-20128 surfaces, exposure is identified through ongoing monitoring rather than surfacing for the first time during an assessor's periodic review.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-20128's remediation deadline of April 23, 2026 has passed. What happens now?
If CVE-2026-20128 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship in good standing.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
