# CVE-2026-20128: Cisco Catalyst SD-WAN Manager recoverable password storage in DCA

Source: https://junglewise.ai/threats/cve-2026-20128-cisco-catalyst-sd-wan-manager-recoverable-password-storage-in-dca  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-20. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-20128 · Severity: critical · CVSS 7.5 · Exploited in the wild · Published 2026-04-20

Cisco Catalyst SD-WAN Manager, a tool used to manage and monitor enterprise wide-area networks, contains a security flaw in its Data Collection Agent feature. An attacker can exploit this to obtain administrative credentials, potentially allowing them to take control of other systems within the SD-WAN infrastructure. This vulnerability has been observed being used in active attacks.

Technologies: [Cisco Catalyst SD-WAN Manager](https://junglewise.ai/threats/technologies/catalyst-sd-wan-manager). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20128 exploited in the wild?** Yes. CVE-2026-20128 is known to be exploited in the wild, first recorded on 20 April 2026. Treat it as urgent.

**How severe is CVE-2026-20128?** Critical severity, with a CVSS score of 7.5, published 20 April 2026.

**Which products and versions are affected?** Cisco Catalyst SD-WAN Manager Versions prior to 20.18.

**Is there a fix for CVE-2026-20128?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20128 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20128?** Check whether you run Cisco Catalyst SD-WAN Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager (formerly vManage) stems from the storage of DCA user credentials in a recoverable format on the filesystem. While initially described as a local privilege escalation, updated advisory data indicates an unauthenticated, remote attacker can exploit this by sending a crafted HTTP request to read the credential file. Successful exploitation allows the attacker to retrieve the DCA password, which can be used to gain unauthorized privileges on the affected system or move laterally to other systems in the SD-WAN environment. This vulnerability is tracked as CWE-257 and is addressed in Cisco Catalyst SD-WAN Manager releases 20.18 and later.

## Affected products

- Cisco Catalyst SD-WAN Manager Versions prior to 20.18

## Timeline

- 2026-03-20: disclosed: Initial vendor disclosure
- 2026-04-20: advisory: NVD publication and CISA KEV addition
- 2026-04-20: exploited: Confirmed active exploitation in the wild per CISA KEV catalog

## Related threats

- [Cisco Catalyst SD-WAN Manager API authentication bypass](https://junglewise.ai/threats/cve-2026-76504-a-vulnerability-in-the-api-session-based-authentication)
- [Cisco Catalyst SD-WAN Manager information disclosure in web interface](https://junglewise.ai/threats/cve-2026-20294-cisco-catalyst-sd-wan-manager-information-disclosure-in-web)
- [Cisco Catalyst SD-WAN Manager arbitrary file write in web UI](https://junglewise.ai/threats/cve-2026-20262-cisco-catalyst-sd-wan-manager-arbitrary-file-write-in-web-ui)
- [Cisco Catalyst SD-WAN Manager privilege escalation in CLI](https://junglewise.ai/threats/cve-2026-20245-cisco-catalyst-sd-wan-manager-privilege-escalation-in-cli)
- [Cisco Catalyst SD-WAN Manager XXE in web UI](https://junglewise.ai/threats/cve-2026-20224-cisco-catalyst-sd-wan-manager-xxe-in-web-ui)