CVE-2026-20133

Cisco · Published February 25, 2026

7.5

CVSS v3.1

HIGH

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

Affected Products

Catalyst SD WAN Manager < 20.9.8.2
Catalyst SD WAN Manager < 20.12.5.3
Catalyst SD WAN Manager < 20.15.4.2
Catalyst SD WAN Manager < 20.18.2.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N