Intel

CVE-2026-20133

Security Advisory 2026-002 — Multiple Vulnerabilities in Cisco Products

criticalKEV: actively exploitedPoCEPSS 31%

Description

A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

Source: CERTEU_ADVISORYCISCO_CSAFCISA_KEVCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

Although the CVSS v3 base score is a moderate 6.5 (attack vector: network, no user interaction required), the EPSS score of 31.4 % at the 98th percentile signals an exceptionally high near-term exploitation probability and is the primary driver for KEV inclusion. Exploitation requires netadmin privileges, but no additional authentication beyond the vShell, which significantly lowers the bar for insider threats or compromised administrative accounts. For NIS2-scoped organisations running SD-WAN infrastructure, the risk is elevated because a successful exploit can expose credentials, device configurations, and network topology data that serve as a springboard for follow-on attacks. CISA has not flagged ransomware use, so the primary damage path is espionage and lateral movement; nonetheless, patch prioritisation should be treated as critical wherever the SD-WAN Manager management interface has any internet exposure.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch: Cisco has released a fix for CVE-2026-20133 — look up the exact version and patch ID in the Cisco Security Advisory (cisco.com/security/advisories) and deploy it immediately across all Cisco Catalyst SD-WAN Manager instances.
  • Restrict netadmin vShell access: Identify all accounts holding netadmin privileges and disable interactive vShell access (vshell command) until the patch is applied, or limit it strictly to approved maintenance windows.
  • Isolate management interfaces: Verify that SD-WAN Manager management ports (typically TCP 443 / 8443 for the web UI and TCP 22 for SSH) are not reachable from the internet; restrict access to a dedicated out-of-band management VLAN or VPN only.
  • Terminate and audit active sessions: Kill all running vShell and SSH sessions to the SD-WAN Manager immediately and review session logs for unknown source IPs.
  • Rotate credentials: Reset passwords and API keys for all netadmin and administrator accounts on the SD-WAN Manager, as the vShell may have allowed reading credentials from the underlying file system.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Place SD-WAN Manager instances in a dedicated management segment (RFC 1918); configure firewall rules so that only authorised jump hosts can reach TCP 22 and TCP 443/8443 — block all other sources.
  • Least-privilege / RBAC: Reduce the number of accounts with netadmin privileges to the absolute minimum; enforce role separation between network administration and SD-WAN configuration using Cisco's built-in RBAC roles.
  • IPS rule: Enable signatures on upstream IPS systems for anomalous access to the SD-WAN Manager file system; configure a Snort/Suricata rule to alert on HTTP responses containing sensitive file content strings (e.g. /etc/passwd in response bodies).
  • MFA for management access: Enforce multi-factor authentication for all administrative access to the SD-WAN Manager (Cisco ISE or TACACS+ with an MFA backend).
  • Centralise audit logging: Ensure syslog forwarding from the SD-WAN Manager to a central SIEM is active; retain logs for at least 90 days in line with NIS2 requirements.

Runbook · Step 3

Detection rules

  • SSH/vShell activity: Monitor auditd or syslog on the SD-WAN Manager for vshell process start events; Sigma shape: process.name: vshell AND user.roles: netadmin — alert on any activation outside scheduled maintenance windows.
  • Sensitive file-system reads: Add a Linux auditd rule (-w /etc/passwd -p r -k sdwan_sensitive_read) on the SD-WAN Manager host; any read of sensitive system files by the vshell process is a direct indicator of exploitation.
  • Anomalous login sources: SIEM correlation rule: authentication events from the SD-WAN Manager with source IPs outside the defined management address space → immediate alert. KQL snippet: source.ip not in (management_cidr_list) AND event.action: "login" AND host.name: "sdwan-manager*".
  • Elevated data volume on management ports: Zeek/Suricata network telemetry: flag unusually large outbound responses (>50 KB) on TCP 22 or 443 from the SD-WAN Manager to external hosts as a potential exfiltration indicator.
  • Repeated authorisation failures: Cluster of authorization failure or file access denied entries in Cisco SD-WAN Manager logs may indicate active reconnaissance or exploitation attempts.

Metrics

Severity
critical
Priority score
226.10
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
6.5
Source: nvd-v3
CVSS v3
6.5
CVSS v4
—
EPSS percentile
98.2 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
31.4 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2026-02-26 00:00 UTC
CWE
CWE-200

Weakness classes (CWE)

  • CWE-200Class

    Exposure of Sensitive Information to an Unauthorized Actor

    The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

    cwe.mitre.org →

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • cisco

    catalyst_sd-wan_manager20.11 – 20.12.5.3

  • cisco

    catalyst_sd-wan_manager20.13 – 20.15.4.2

  • cisco

    catalyst_sd-wan_manager20.16 – 20.18.2.1

  • cisco

    catalyst_sd-wan_manager20.9.8.2

  • cisco

    catalyst_sd-wan_manager

  • cisco

    sd-wan_vbond_orchestrator20.11 – 20.12.5.3

  • cisco

    sd-wan_vbond_orchestrator20.13 – 20.15.4.2

  • cisco

    sd-wan_vbond_orchestrator20.16 – 20.18.2.1

  • cisco

    sd-wan_vbond_orchestrator20.9.8.2

  • cisco

    sd-wan_vbond_orchestrator

  • cisco

    sd-wan_vsmart_controller20.11 – 20.12.5.3

  • cisco

    sd-wan_vsmart_controller20.13 – 20.15.4.2

  • cisco

    sd-wan_vsmart_controller20.16 – 20.18.2.1

  • cisco

    sd-wan_vsmart_controller20.9.8.2

  • cisco

    sd-wan_vsmart_controller

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Linked advisories

IDCVE-2026-20133