CVE-2026-20133

A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system.

High Known exploited

Severity: 7.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): 31.48%; Chance of exploitation in the next 30 days. Higher than 98.28% of scored vulnerabilities.
Known exploited: Yes; In CISA's catalog since Apr 20, 2026
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Fix: None yet; No fixed version published

Exploited in the wild. Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (Cisco Catalyst SD-WAN Manager). Required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Due for U.S. federal agencies by Apr 23, 2026.

Description

A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it

Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Advisories

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-…

Timeline

Feb 25, 2026 Published
Apr 20, 2026 Added to CISA's Known Exploited Vulnerabilities catalog
Apr 23, 2026 Remediation due for U.S. federal agencies
Jun 17, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-j7qq-vr8c-xvw3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans	Medium	Same weakness, CWE-200
GHSA-gqh3-7856-rjjg ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)	Medium	Same weakness, CWE-200
GHSA-rqgm-cfrp-4hx8 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API	Medium	Same weakness, CWE-200
GHSA-f66c-mpj2-3r8h ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user	Medium	Same weakness, CWE-200
GHSA-vfpm-58rq-9qcg Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`	Medium	Same weakness, CWE-200
GHSA-23mf-xhv8-69c2 GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)	High	Same weakness, CWE-200
GHSA-fx3j-rwgx-fr94 GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name	High	Same weakness, CWE-200
GHSA-vp88-798v-h67f rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert	Low	Same weakness, CWE-200

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor