Privilege Escalation Risk in Cisco Catalyst SD-WAN Manager

Historical catalog analysis: CISA added this entry on April 20, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-20128 is a security flaw in the Cisco Catalyst SD-WAN Manager where passwords are stored in a recoverable format (CWE-257). This vulnerability allows an authenticated attacker who already has local, low-privileged access to the filesystem to access a credential file. By doing so, the attacker could gain DCA user privileges, effectively escalating their level of control within the system.

Exposure and applicability

This vulnerability is applicable to healthcare organizations utilizing Cisco Catalyst SD-WAN Manager to orchestrate network connectivity across clinical sites, data centers, or connections with business associates. Because this software manages the network plane, unauthorized privilege escalation could allow an attacker to manipulate network configurations or gain visibility into traffic patterns.

While CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on April 20, 2026, it is important to note that the exploit requires local access; it is not described as a remote execution flaw. However, for healthcare providers, any compromise of the network management layer increases the risk of unauthorized access to electronic Protected Health Information (ePHI) and could threaten the operational resilience of patient care systems.

Remediation priorities

Our analysis suggests that security leaders and clinical engineering teams prioritize the following actions to reduce exposure:

1. Apply Vendor Updates: Prioritize the deployment of patches or updates provided by Cisco specifically addressing CVE-2026-20128. This is the primary method to address the recoverable password storage issue.
2. Implement Hardening Guidance: Review and apply the “Hunt & Hardening Guidance for Cisco SD-WAN Devices” as referenced in CISA Emergency Directive 26-03. This may help reduce the likelihood of an attacker gaining the initial local access required to exploit this flaw.
3. Restrict Local Access: Audit and limit the number of users with local filesystem access to the SD-WAN Manager. Reducing the pool of authenticated low-privileged users limits the potential attack surface for this specific privilege escalation path.

How to validate remediation

To verify that exposure has been reduced, organizations should perform the following checks:

• Version Verification: Confirm through the management console that the SD-WAN Manager is running a version where Cisco has remediated CVE-2026-20128.
• Access Audit: Review local user accounts and filesystem permissions to ensure only authorized administrative personnel have access, reducing the risk of a low-privileged user attempting to access credential files.
• Configuration Review: Validate that hardening settings recommended in CISA’s guidance have been applied across all managed SD-WAN instances.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in ransomware campaigns. Additionally, while CISA issued a deadline of April 23, 2026, for federal agencies, private healthcare providers should determine their own patching cadence based on their internal risk management frameworks and the criticality of their SD-WAN deployment.

Because this is a local privilege escalation vulnerability, patching the software does not eliminate the risk of initial entry into the system; it only prevents an attacker from using this specific method to gain DCA privileges once they are already inside. Residual risk remains if other vulnerabilities allow initial authenticated access.

Source and editorial note

CVE-2026-20128: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability · Source date: April 20, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: April 23, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 11, 2026 at 01:23 UTC.

Request a healthcare security assessment