# CVE-2026-20209: Cisco Catalyst SD-WAN Manager privilege escalation in web UI Source: https://junglewise.ai/threats/cve-2026-20209-cisco-catalyst-sd-wan-manager-privilege-escalation-in-web-ui Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-05-14. Updated: 2026-06-29 License: CC BY 4.0 with a link back CVE-2026-20209 · Severity: medium · CVSS 5.4 · Published 2026-05-14 Cisco Catalyst SD-WAN Manager, a tool used to centrally manage and configure software-defined networks, contains a security flaw that could allow a user with limited access to gain full administrative control. This occurs because the system inadvertently records sensitive session data in its activity logs, which a low-privileged user can view. If exploited, an attacker could change network configurations, disrupt services, or access sensitive operational data. Technologies: [Cisco Catalyst SD-WAN Manager](https://junglewise.ai/threats/technologies/catalyst-sd-wan-manager). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco). ## Quick answers **Is CVE-2026-20209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20209 being exploited in the wild. **How severe is CVE-2026-20209?** Medium severity, with a CVSS score of 5.4, published 14 May 2026. **Which products and versions are affected?** Cisco Catalyst SD-WAN Manager Earlier than 20.9, 20.9 before 20.9.9.1, 20.10 before 20.12.7.1, 20.11 before 20.12.7.1, 20.12 before 20.12.5.4, 20.13 before 20.15.5.2, 20.14 before 20.15.5.2, 20.15 before 20.15.4.4, 20.16 before 20.18.2.2, 26.1 before 26.1.1.1, Earlier than 20.9, 20.9, 20.10, 20.11, 20.12, 20.13, 20.14, 20.15, 20.16, 20.18, 26.1. **Is there a fix for CVE-2026-20209?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it. **How is CVE-2026-20209 attacked?** It is attacked over the network, in a network appliance. **Am I affected by CVE-2026-20209?** Check whether you run Cisco Catalyst SD-WAN Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details A privilege escalation vulnerability exists in the web UI of Cisco Catalyst SD-WAN Manager (formerly vManage) due to the logging of excessive data (CWE-779). The system records sensitive session information within audit logs that are accessible to users with read-only permissions. An authenticated, remote attacker with low privileges can extract this session data to impersonate a high-privileged user. Once elevated, the attacker can perform any action available to an administrator, including modifying device configurations and templates. Cisco has released software updates to address this issue; no workarounds are available. ## Affected products - Cisco Catalyst SD-WAN Manager Earlier than 20.9, 20.9 before 20.9.9.1, 20.10 before 20.12.7.1, 20.11 before 20.12.7.1, 20.12 before 20.12.5.4, 20.13 before 20.15.5.2, 20.14 before 20.15.5.2, 20.15 before 20.15.4.4, 20.16 before 20.18.2.2, 26.1 before 26.1.1.1 ## Timeline - 2026-05-14: advisory: Initial publication by Cisco ## References - [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R) - [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk) ## Related threats - [Cisco Catalyst SD-WAN Manager API authentication bypass](https://junglewise.ai/threats/cve-2026-76504-a-vulnerability-in-the-api-session-based-authentication) - [Cisco Catalyst SD-WAN Manager information disclosure in web interface](https://junglewise.ai/threats/cve-2026-20294-cisco-catalyst-sd-wan-manager-information-disclosure-in-web) - [Cisco Catalyst SD-WAN Manager arbitrary file write in web UI](https://junglewise.ai/threats/cve-2026-20262-cisco-catalyst-sd-wan-manager-arbitrary-file-write-in-web-ui) - [Cisco Catalyst SD-WAN Manager privilege escalation in CLI](https://junglewise.ai/threats/cve-2026-20245-cisco-catalyst-sd-wan-manager-privilege-escalation-in-cli) - [Cisco Catalyst SD-WAN Manager XXE in web UI](https://junglewise.ai/threats/cve-2026-20224-cisco-catalyst-sd-wan-manager-xxe-in-web-ui)