CVE-2026-20133

Unauthenticated Remote Information Disclosure via File System Restrictions in Cisco Catalyst SD-WAN Manager

Published Feb 25, 2026 CVSS 3.1 · 6.5 Medium EPSS 35.3% KEV · Listed
Description
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system.

This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Unauthenticated Remote Information Disclosure via File System Restrictions in Cisco Catalyst SD-WAN Manager
Type Values Removed Values Added
Title Unrestricted File System Access Enables Information Disclosure in Cisco Catalyst SD-WAN Manager
Type Values Removed Values Added
Title Unrestricted File System Access Enables Information Disclosure in Cisco Catalyst SD-WAN Manager
Type Values Removed Values Added
Title Remote Information Disclosure via Insufficient File System Restrictions in Cisco Catalyst SD-WAN Manager
Type Values Removed Values Added
Title Remote Information Disclosure via Insufficient File System Restrictions in Cisco Catalyst SD-WAN Manager
Type Values Removed Values Added
Title Information Disclosure via Insufficient File System Restrictions in Cisco Catalyst SD-WAN Manager
Type Values Removed Values Added
Title Information Disclosure via Insufficient File System Restrictions in Cisco Catalyst SD-WAN Manager
Type Values Removed Values Added
Title Information Disclosure via Insufficient File System Restrictions in Cisco Catalyst SD-WAN Manager
Type Values Removed Values Added
Title Information Disclosure via Insufficient File System Restrictions in Cisco Catalyst SD-WAN Manager
Type Values Removed Values Added
Title Information Disclosure via File System Restrictions in Cisco Catalyst SD-WAN Manager
Type Values Removed Values Added
Title Information Disclosure via File System Restrictions in Cisco Catalyst SD-WAN Manager
Type Values Removed Values Added
Title Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
Type Values Removed Values Added
Description A vulnerability in Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system access restrictions. An attacker could exploit this vulnerability by accessing the API of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system. A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-04-20T00:00:00+00:00', 'dueDate': '2026-04-23T00:00:00+00:00'}

Type Values Removed Values Added
CPEs cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Cisco
Cisco catalyst Sd-wan Manager
Vendors & Products Cisco
Cisco catalyst Sd-wan Manager
Type Values Removed Values Added
Description A vulnerability in Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system access restrictions. An attacker could exploit this vulnerability by accessing the API of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.
Title Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
cisco
Published
Updated
Apr 22, 2026, 3:31 PM
Reserved
Oct 8, 2025, 11:59 AM
Status
Analyzed
Published
Feb 25, 2026, 5:25 PM
Modified
Jun 17, 2026, 10:17 AM