Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
- Severity
- High7.5CVSS 3.1, High
- EPSS
- 32%
- Published
- 25 Feb 2026
- Updated
- 17 Jun 2026
Description
Title, description and vendor guidance are quoted from the source records.
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.
Weakness: CWE-200
Known exploited
Added to CISA KEV on 20 Apr 2026
Federal remediation due date: 23 Apr 2026
Required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Exploit prediction
32% probability of exploitation in the next 30 days (percentile 98%).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Patcharo shows this vulnerability for information but does not match versions for this product yet.
- Cisco Cisco Catalyst SD-WAN Manager · 17.2.6, 17.2.7, 17.2.8, 17.2.9, 17.2.10, 17.2.4, 17.2.5, 18.3.1.1, 18.3.3.1, 18.3.3, 18.3.4, 18.3.5 and 149 more
References
Provenance
Every fact on this page comes from the sources below. Nothing is written by an AI.
- Cisco (CVE record)
- Cisco (CVE record) · 27 Sept 2026, 23:46 UTC · Parser patcharo-cve5/1.1.0
- CISA Known Exploited Vulnerabilities
- CISA Known Exploited Vulnerabilities · 27 Sept 2026, 23:42 UTC · Parser patcharo-kev/1.0.0
- NVD
- NVD · 27 Sept 2026, 23:44 UTC · Parser patcharo-nvd/1.0.0
- FIRST EPSS
- FIRST EPSS · 27 Sept 2026, 23:46 UTC · Parser patcharo-epss/1.0.0
Last verified: 28 Sept 2026, 02:31 UTC