Is CVE-2026-20210 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20210 being exploited in the wild.

How severe is CVE-2026-20210?

Medium severity, with a CVSS score of 5.4, published 14 May 2026.

Which products and versions are affected?

Cisco Catalyst SD-WAN Manager Earlier than 20.9, 20.9 before 20.9.9.1, 20.10 before 20.12.7.1, 20.11 before 20.12.7.1, 20.12 before 20.12.5.4, 20.13 before 20.15.5.2, 20.14 before 20.15.5.2, 20.15 before 20.15.4.4, 20.16 before 20.18.2.2, 20.18 before 20.18.2.2, 26.1 before 26.1.1.1, Earlier than 20.9, 20.9.9.1, 20.12.7.1, 20.15.5.2, 20.18.2.2, 26.1.1.1.

Is there a fix for CVE-2026-20210?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-20210 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-20210?

Check whether you run Cisco Catalyst SD-WAN Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20210: Cisco Catalyst SD-WAN Manager privilege escalation in web UI

CVE-2026-20210 · Severity: medium · CVSS 5.4 · Published 2026-05-14

Cisco Catalyst SD-WAN Manager is a centralized management platform used to configure and monitor corporate software-defined networks. A security flaw in its web interface allows a user with restricted, read-only access to view sensitive information that should have been hidden. An attacker can use this information to gain full administrative control, allowing them to change network settings or disrupt operations.

Technologies: Cisco Catalyst SD-WAN Manager. Vendors: Cisco.

Quick answers

Is CVE-2026-20210 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20210 being exploited in the wild.
How severe is CVE-2026-20210?: Medium severity, with a CVSS score of 5.4, published 14 May 2026.
Which products and versions are affected?: Cisco Catalyst SD-WAN Manager Earlier than 20.9, 20.9 before 20.9.9.1, 20.10 before 20.12.7.1, 20.11 before 20.12.7.1, 20.12 before 20.12.5.4, 20.13 before 20.15.5.2, 20.14 before 20.15.5.2, 20.15 before 20.15.4.4, 20.16 before 20.18.2.2, 20.18 before 20.18.2.2, 26.1 before 26.1.1.1, Earlier than 20.9, 20.9.9.1, 20.12.7.1, 20.15.5.2, 20.18.2.2, 26.1.1.1.
Is there a fix for CVE-2026-20210?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20210 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20210?: Check whether you run Cisco Catalyst SD-WAN Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in the web UI of Cisco Catalyst SD-WAN Manager (formerly vManage) due to a failure to properly redact sensitive information within device configurations and templates. An authenticated, remote attacker with low-privileged (read-only) access can exploit this by extracting sensitive data from these templates to elevate their permissions to those of a high-privileged user. Once elevated, the attacker can modify configuration settings and perform unauthorized administrative actions across the SD-WAN fabric. This issue is tracked as Cisco Bug ID CSCwt38767 and has been addressed in multiple software update trains including 20.9.9.1, 20.12.7.1, and 20.15.5.2.

Affected products

Cisco Catalyst SD-WAN Manager Earlier than 20.9, 20.9.9.1, 20.12.7.1, 20.15.5.2, 20.18.2.2, 26.1.1.1

Timeline

2026-05-14: advisory: Initial advisory published by Cisco

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.