CVE detail
CVE-2026-20122: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
Source: CISA Known Exploited Vulnerabilities catalog · back to feed
Vendor / product
Cisco · Catalyst SD-WAN Manger
- Date added (KEV)
- Apr 20, 2026
- CISA due date
- Apr 23, 2026
- Ransomware campaign use
- Unknown
Required action
Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Vendor fix: Vendor advisory
Scorifya interpretation
AI-generatedA short, structured read of the record above, generated when this page first loads, then cached for a week.
Plain English
Technical detail
From CISA
Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ; https://nvd.nist.gov/vuln/detail/CVE-2026-20122
See what attackers can see on your domain
This vulnerability is on CISA's Known Exploited Vulnerabilities list, so it is being exploited in the wild right now. Scorifya can't test for Cisco directly, but in about 30 seconds it shows what your own domain exposes publicly across TLS, security headers, DNS, and cookies: the surface attackers probe first.
SOC 2 compliance
Tracking remediation across your cloud infrastructure?
Scorifya Controls automates 54 SOC 2 checks across AWS, GitHub, GCP, and Azure, and gives you a manual evidence trail for the controls no tool can automate. Self-hosted, three tiers from $149/mo.
See Scorifya Controls →References
Other recent CVEs from Cisco
- CVE-2026-76504Catalyst SD-WAN Manager, Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
- CVE-2026-76460Identity Services Engine, Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
- CVE-2026-76461Secure Email Gateway, Cisco Secure Email Gateway SQL Injection Vulnerability
- CVE-2026-20079Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management, Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2026-20349Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD), Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability