FlagThis
← Back to CVE List
Vulnerability Intelligence Report
Cisco Catayst SD-WAN Authentication Bypass Vulnerability

CVE-2026-20129

A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected system as a user who has the netadmin role. The vulnerability is due to improper authentication for requests that are sent to the API. An attacker could exploit this vulnerability by sending a crafted request to the API of an affected system. A successful exploit could allow the attacker to execute commands with the privileges of the netadmin role. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability. 

No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:0.72%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—

Weaknesses (CWE)

CWE-287 ↗Improper Authentication

Affected Products & Versions

Vendor Product Affected Versions
Cisco Cisco Catalyst SD-WAN Manager 20.1.12 (affected), 19.2.1 (affected), 18.4.4 (affected), 18.4.5 (affected), 20.1.1.1 (affected), 20.1.1 (affected), 19.3.0 (affected), 19.2.2 (affected), 19.2.099 (affected), 18.3.6 (affected), 18.3.7 (affected), 19.2.0 (affected), 18.3.8 (affected), 19.0.0 (affected), 19.1.0 (affected), 18.4.302 (affected), 18.4.303 (affected), 19.2.097 (affected), 19.2.098 (affected), 17.2.10 (affected), 18.3.6.1 (affected), 19.0.1a (affected), 18.2.0 (affected), 18.4.3 (affected), 18.4.1 (affected), 17.2.8 (affected), 18.3.3.1 (affected), 18.4.0 (affected), 18.3.1 (affected), 17.2.6 (affected), 17.2.9 (affected), 18.3.4 (affected), 17.2.5 (affected), 18.3.1.1 (affected), 18.3.5 (affected), 18.4.0.1 (affected), 18.3.3 (affected), 17.2.7 (affected), 17.2.4 (affected), 18.3.0 (affected), 19.2.3 (affected), 18.4.501_ES (affected), 20.3.1 (affected), 20.1.2 (affected), 19.2.929 (affected), 19.2.31 (affected), 20.3.2 (affected), 19.2.32 (affected), 20.3.2_925 (affected), 20.3.2.1 (affected), 20.3.2.1_927 (affected), 18.4.6 (affected), 20.1.2_937 (affected), 20.4.1 (affected), 20.3.2_928 (affected), 20.3.2_929 (affected), 20.4.1.0.1 (affected), 20.3.2.1_930 (affected), 19.2.4 (affected), 20.5.0.1.1 (affected), 20.4.1.1 (affected), 20.3.3 (affected), 19.2.4.0.1 (affected), 20.3.2_937 (affected), 20.3.3.1 (affected), 20.5.1 (affected), 20.1.3 (affected), 20.3.3.0.4 (affected), 20.3.3.1.2 (affected), 20.3.3.1.1 (affected), 20.4.1.2 (affected), 20.3.3.0.2 (affected), 20.4.1.1.5 (affected), 20.4.1.0.01 (affected), 20.4.1.0.02 (affected), 20.3.3.1.7 (affected), 20.3.3.1.5 (affected), 20.5.1.0.1 (affected), 20.3.3.1.10 (affected), 20.3.3.0.8 (affected), 20.4.2 (affected), 20.4.2.0.1 (affected), 20.3.4 (affected), 20.3.3.0.14 (affected), 19.2.4.0.8 (affected), 19.2.4.0.9 (affected), 20.3.4.0.1 (affected), 20.3.2.0.5 (affected), 20.6.1 (affected), 20.5.1.0.2 (affected), 20.3.3.0.17 (affected), 20.6.1.1 (affected), 20.6.0.18.3 (affected), 20.3.2.0.6 (affected), 20.6.0.18.4 (affected), 20.4.2.0.2 (affected), 20.3.3.0.16 (affected), 20.3.4.0.5 (affected), 20.6.1.0.1 (affected), 20.3.4.0.6 (affected), 20.6.2 (affected), 20.7.1EFT2 (affected), 20.3.4.0.9 (affected), 20.3.4.0.11 (affected), 20.4.2.0.4 (affected), 20.3.3.0.18 (affected), 20.7.1 (affected), 20.6.2.1 (affected), 20.3.4.1 (affected), 20.5.1.1 (affected), 20.4.2.1 (affected), 20.4.2.1.1 (affected), 20.3.4.1.1 (affected), 20.3.813 (affected), 20.3.4.0.19 (affected), 20.4.2.2.1 (affected), 20.5.1.2 (affected), 20.3.4.2 (affected), 20.3.814 (affected), 20.4.2.2 (affected), 20.6.2.2 (affected), 20.3.4.2.1 (affected), 20.7.1.1 (affected), 20.3.4.1.2 (affected), 20.6.2.2.2 (affected), 20.3.4.0.20 (affected), 20.6.2.2.3 (affected), 20.4.2.2.2 (affected), 20.3.5 (affected), 20.6.2.0.4 (affected), 20.4.2.2.3 (affected), 20.3.4.0.24 (affected), 20.6.2.2.7 (affected), 20.6.3 (affected), 20.3.4.2.2 (affected), 20.4.2.2.4 (affected), 20.7.1.0.2 (affected), 20.8.1 (affected), 20.3.5.0.8 (affected), 20.3.5.0.9 (affected), 20.4.2.2.8 (affected), 20.3.5.0.7 (affected), 20.6.3.0.7 (affected), 20.6.3.0.5 (affected), 20.6.3.0.10 (affected), 20.6.3.0.2 (affected), 20.7.2 (affected), 20.9.1EFT2 (affected), 20.6.3.0.11 (affected), 20.6.3.1 (affected), 20.6.3.0.14 (affected), 20.6.4 (affected), 20.9.1 (affected), 20.6.3.0.19 (affected), 20.6.3.0.18 (affected), 20.3.6 (affected), 20.9.1.1 (affected), 20.6.3.0.23 (affected), 20.6.4.0.4 (affected), 20.6.3.0.25 (affected), 20.6.5 (affected), 20.6.3.0.27 (affected), 20.9.2 (affected), 20.9.2.1 (affected), 20.6.3.0.29 (affected), 20.6.3.0.31 (affected), 20.6.3.0.32 (affected), 20.10.1 (affected), 20.6.3.0.33 (affected), 20.9.2.0.01 (affected), 20.9.1_LI_Images (affected), 20.10.1_LI_Images (affected), 20.9.2_LI_Images (affected), 20.3.7 (affected), 20.9.3 (affected), 20.6.5.1 (affected), 20.11.1 (affected), 20.11.1_LI_Images (affected), 20.9.3_LI_ Images (affected), 20.6.3.1.1 (affected), 20.9.3.0.2 (affected), 20.6.5.1.2 (affected), 20.9.3.0.3 (affected), 20.4.2.3 (affected), 20.6.3.2 (affected), 20.6.4.1 (affected), 20.6.3.0.38 (affected), 20.6.3.0.39 (affected), 20.3.5.1 (affected), 20.3.4.3 (affected), 20.9.3.1 (affected), 20.3.3.2 (affected), 20.6.5.2 (affected), 20.3.7.1 (affected), 20.10.1.1 (affected), 20.6.5.2.1 (affected), 20.3.4.0.25 (affected), 20.6.2.2.4 (affected), 20.6.1.2 (affected), 20.11.1.1 (affected), 20.9.3.0.5 (affected), 20.3.4.0.26 (affected), 20.6.5.1.3 (affected), 20.6.3.0.40 (affected), 20.1.3.1 (affected), 20.9.2.2 (affected), 20.6.5.2.3 (affected), 20.6.5.1.4 (affected), 20.6.5.3 (affected), 20.6.3.0.41 (affected), 20.9.3.0.7 (affected), 20.6.5.1.5 (affected), 20.9.3.0.4 (affected), 20.6.4.0.19 (affected), 20.6.5.1.6 (affected), 20.9.3.0.8 (affected), 20.6.3.3 (affected), 20.3.7.2 (affected), 20.6.5.4 (affected), 20.6.5.1.7 (affected), 20.9.3.0.12 (affected), 20.6.4.2 (affected), 20.6.5.5 (affected), 20.9.3.2 (affected), 20.11.1.2 (affected), 20.6.3.4 (affected), 20.10.1.2 (affected), 20.6.5.1.9 (affected), 20.9.3.0.16 (affected), 20.6.3.0.45 (affected), 20.6.5.1.10 (affected), 20.9.3.0.17 (affected), 20.6.5.2.4 (affected), 20.6.4.0.21 (affected), 20.9.3.0.18 (affected), 20.6.3.0.46 (affected), 20.6.3.0.47 (affected), 20.9.2.3 (affected), 20.9.3.2_LI_Images (affected), 20.9.3.0.21 (affected), 20.9.3.0.20 (affected), 20.9.4_LI_Images (affected), 20.9.4 (affected), 20.6.5.1.11 (affected), 20.12.1 (affected), 20.12.1_LI_Images (affected), 20.6.5.1.13 (affected), 20.9.3.0.23 (affected), 20.6.5.2.8 (affected), 20.9.4.1 (affected), 20.9.4.1_LI_Images (affected), 20.9.3.0.25 (affected), 20.9.3.0.24 (affected), 20.6.5.1.14 (affected), 20.3.8 (affected), 20.6.6 (affected), 20.9.3.0.26 (affected), 20.6.3.0.51 (affected), 20.9.3.0.29 (affected), 20.12.2 (affected), 20.12.2_LI_Images (affected), 20.6.6.0.1 (affected), 20.13.1_LI_Images (affected), 20.9.4.0.4 (affected), 20.13.1 (affected), 20.9.4.1.1 (affected), 20.9.5 (affected), 20.9.5_LI_Images (affected), 20.12.3_LI_Images (affected), 20.12.3 (affected), 20.9.4.1.3 (affected), 20.6.7 (affected), 20.9.5.1 (affected), 20.9.5.1_LI_Images (affected), 20.9.4.1.6 (affected), 20.14.1 (affected), 20.14.1_LI_Images (affected), 20.9.5.2 (affected), 20.9.5.2.1 (affected), 20.9.5.2_LI_Images (affected), 20.12.3.1 (affected), 20.12.4 (affected), 20.15.1_LI_Images (affected), 20.15.1 (affected), 20.9.5.1.4 (affected), 20.9.5.2.7 (affected), 20.9.5.2.13 (affected), 20.9.6 (affected), 20.9.6_LI_Images (affected), 20.9.5.2.14 (affected), 20.6.8 (affected), 20.12.4.0.03 (affected), 20.16.1 (affected), 20.16.1_LI_Images (affected), 20.12.4_LI_Images (affected), 20.9.5.2.16 (affected), 20.12.4.0.4 (affected), 20.12.401 (affected), 20.9.5.3 (affected), 20.9.5.3_LI_Images (affected), 20.12.4.1_LI_Images (affected), 20.12.4.1 (affected), 20.9.5.2.21 (affected), 20.9.6.0.3 (affected), 20.12.4.0.6 (affected), 20.15.2_LI_Images (affected), 20.15.2 (affected), 20.12.4_Monthly_ES5 (affected), 20.12.5 (affected), 20.12.5_LI_Images (affected), 20.9.7_LI _Images (affected), 20.9.7 (affected), 20.15.3 (affected), 20.15.3_ LI _Images (affected), 20.12.501 (affected), 20.12.5.1_LI_Images (affected), 20.12.5.1 (affected), 20.12.5.2_LI_Images (affected), 20.12.5.2 (affected), 20.15.3.1 (affected), 20.15.4_LI_Images (affected), 20.15.4 (affected), 20.9.7.1_LI _Images (affected), 20.9.7.1 (affected), 20.18.1 (affected), 20.18.1_LI_Images (affected), 20.12.6_LI_Images (affected), 20.12.6 (affected), 20.12.5.1.01 (affected), 20.9.8 (affected), 20.9.8_LI_Images (affected), 20.18.2 (affected), 20.15.4.1_LI_Images (affected), 20.15.4.1 (affected), 20.18.2_LI_Images (affected)

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗
No reference links found.

Threat Intelligence Signals

EPSS Score
0.717%
GitHub Advisory
GHSA-5h54-2f2f-5x5c ↗

Identity & Timeline

StatusPUBLISHED
Assigning AuthorityCisco Systems, Inc. · Hosted Service · USA
Reserved2025-10-08T11:59:15
Published2026-02-25T16:14:09
Last Updated2026-03-20T21:47:59

Related Intelligence

Related CVEs
CVE-2026-20182 CVSS 10.0 — May 2026: This security advisory provides the details and fix informat…
CVE-2026-20127 CVSS 10.0 — A vulnerability in the peering authentication in Cisco Catalyst SD-WAN…
CVE-2026-20303 CVSS 9.9 — As part of Cisco's ongoing commitment to proactive security and produc…
CVE-2026-20304 CVSS 9.9 — As part of Cisco's ongoing commitment to proactive security and produc…
CVE-2026-20310 CVSS 9.1 — As part of Cisco's ongoing commitment to proactive security and produc…
LINK COPIED TO CLIPBOARD