Credential Exposure Vulnerability in Cisco Catalyst SD-WAN Manager

CVE-2026-20128

What is CVE-2026-20128?

A vulnerability in Cisco Catalyst SD-WAN Manager's Data Collection Agent (DCA) feature allows an authenticated local attacker to gain unauthorized DCA user privileges. This security issue arises from the presence of a credential file containing the DCA password on the filesystem. If an attacker has valid credentials for vManage, they can access this file and exploit the vulnerability to elevate their privileges. This could potentially allow the attacker to gain access to other affected systems.

References