Cyber Posture

CVE-2026-20129

Critical

Published: 25 February 2026

Published
25 February 2026
Modified
04 March 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0006 17.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2026-20129 is a high-severity authentication bypass vulnerability (CWE-287) in the API user authentication mechanism of Cisco Catalyst SD-WAN Manager. Published on 2026-02-25, it stems from improper authentication handling for API requests, enabling an unauthenticated remote attacker to gain unauthorized access to affected systems. The issue affects Cisco Catalyst SD-WAN Manager releases prior to version 20.18.

An unauthenticated, remote attacker can exploit this vulnerability by sending a crafted request to the API endpoint of an affected system. Successful exploitation grants the attacker access equivalent to a user with the netadmin role, allowing them to execute arbitrary commands with those elevated privileges. The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical impact with high confidentiality, integrity, and availability consequences.

Cisco's security advisory notes that Catalyst SD-WAN Manager releases 20.18 and later are not affected, recommending upgrade to a patched version for mitigation. Additional details are available in the official advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v.

Details

CWE(s)
CWE-287

Affected Products

cisco
catalyst sd-wan manager
20.12.6 · ≤ 20.9.8.2 · 20.11 — 20.12.5.3 · 20.13 — 20.15.4.2

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is an authentication bypass in a public-facing API endpoint, directly enabling exploitation of a public-facing application to gain unauthorized elevated (netadmin) access and execute arbitrary commands.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References