CVE-2026-20128: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

Quick Answer

Cisco now describes CVE-2026-20128 as unauthenticated remote disclosure of a Data Collection Agent credential through a crafted HTTP request, potentially granting DCA-user access to another affected system. CISA's current description still says authenticated local access; those prerequisites disagree. Use Cisco's revised exposure guidance, check the Manager release and preserve DCA/API logs. Cisco excludes releases 20.18 and later from this CVE, but that is not an exclusion from the other SD-WAN flaws in the grouped advisory.

Evidence check: The vendor evidence and its limits are described below. CISA KEV catalog 2026.10.02 was checked October 2; catalog chronology is separate from vendor publication history and evidence of compromise in your deployment. No exploit or update test is claimed.

Context

Status At A Glance

Product scope	Cisco — Catalyst SD-WAN Manager
CVE	CVE-2026-20128
TechGeeks response tier	P0 — confirm an exact match and act now
CISA KEV added	2026-04-20
Vendor severity	High (Cisco individual-CVE rating).
CVSS	7.5 (Cisco CVSS v3.1 base; revised remote, unauthenticated vector).
Ransomware field	Unknown — this is not the same as No; CISA has not marked the field Known.
Forensic-triage field	No in the current CISA field; organizations should still investigate when exposure or evidence warrants it.
CWE	CWE-257
Federal remediation date	2026-04-23 — applies to covered federal agencies; other organizations should set a risk-based deadline.

What Happened

Credential-disclosure prerequisite conflict: CISA retains an authenticated-local description, while Cisco's revised Details section identifies unauthenticated remote HTTP access to the DCA credential file. This notice does not resolve that source discrepancy by assuming credentials are required. CISA confirms exploitation, not its prevalence or compromise of a particular Manager.

Affected Scope

Inventory Manager releases and the DCA feature against the current Cisco advisory. Cisco excludes 20.18 and later from CVE-2026-20128; its affected-release statement otherwise does not require a special device configuration. Keep that CVE-specific exclusion separate from other flaws covered by the same advisory.

Match the exact edition, hardware or virtual platform, release, patch level, enabled feature, and management exposure. A product-family name alone is not enough to establish applicability.

Steps

What To Do Now

1. Confirm. Inventory every Catalyst SD-WAN Manager asset and record its exact version, patch level, role, relevant configuration, and exposure.
2. Preserve. Retain /var/log/nms/containers/service-proxy/serviceproxy-access.log and look for the DCA credential-file path identified in Cisco's advisory. Compare timestamps and source IPs with authorized DCA administration before classifying a request as malicious; a clean search is not proof that the credential stayed private.
3. Contain. Restrict unnecessary internet and management-plane access using supported controls. Follow the live advisory: Open the live Cisco advisory.
4. Remediate. Confirm the exact product, release, exposure, and prerequisites against the live vendor advisory, then apply the vendor-listed update or mitigation. CISA added CVE-2026-20128 to KEV on 2026-04-20.
5. Validate. Verify the resulting version or patch level, service health, logging, expected access, an expected denial, and representative dependent workflows.
6. Escalate. If exposure overlapped the vulnerable period or evidence is suspicious, treat the system as a potential incident and follow vendor and incident-response recovery guidance.

Fixed Releases And Mitigation

Investigation And Recovery

CISA's KEV record does not mark this entry for forensic triage. That field is not proof of a clean system; consult the vendor advisory for indicators and recovery guidance.

When an attacker may have gained administrative, root, SYSTEM, identity, management-plane, or code-execution access, patching alone is not an eradication claim. Preserve evidence, scope affected accounts and downstream systems, rotate exposed credentials or certificates when justified, and rebuild from a trusted source when vendor or incident-response guidance requires it.

Notes

Exploitation Evidence

Vendor statement: Cisco reports active exploitation of CVE-2026-20128 in March 2026. This precedes the April 20 KEV addition; neither date establishes when a particular deployment was first exposed.

CISA statement: CVE-2026-20128 was added to KEV on 2026-04-20. The ransomware field is Unknown, and the forensic-triage field is No. These are separate signals.

Validation And Boundaries

This notice does not prove that every product carrying the family name is affected, that exploitation is widespread, that a clean indicator search rules out compromise, or that a successful update restored trust. TechGeeks has not reproduced the exploit and does not replace the vendor advisory, asset inventory, vulnerability scanner, or incident-response process.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices
• What to Do When a Device Hits CISA KEV
• Router CVE Exposure, Version, and Mitigation Checklist
• IoT Firmware Update and End-of-Support Checklist
• Live Protect and Runtime Vulnerability Shielding

References

• Cisco advisory or support notice
• CISA guidance
• CISA guidance
• NVD CVE record
• CISA source

Wrap-Up

Record whether CVE-2026-20128 applies to your environment. If it does, assign an owner, preserve the change and investigation evidence, complete the vendor action, and document the validated result.

Correction policy: If a primary source changes affected versions, remediation, exploitation status, or recovery guidance, TechGeeks will update this page and its verification date.