XML External Entity Exposure in Cisco Catalyst SD-WAN Manager

CVE-2026-20224

What is CVE-2026-20224?

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could enable a remote, unauthenticated attacker to read arbitrary files on the affected system. This issue arises from inadequate handling of XML External Entities (XXE) during XML file parsing. An attacker can exploit this flaw by sending a specially crafted request, successfully allowing them to access sensitive files stored within the affected system. This vulnerability poses a significant risk, as it does not require valid user credentials and can lead to unauthorized data exposure.

References