VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Feb 25, 2026· Updated Jun 17, 2026

CVE-2026-20129

CVE-2026-20129

Description

A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected system as a user who has the netadmin role.

The vulnerability is due to improper authentication for requests that are sent to the API. An attacker could exploit this vulnerability by sending a crafted request to the API of an affected system. A successful exploit could allow the attacker to execute commands with the privileges of the netadmin role. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Cisco Systems, Inc./Catalyst SD-WAN Manager4 versions
    cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*range: <20.9.8.2
    • cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*
    • (no CPE)range: 20.1.12
    • (no CPE)range: <20.18

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.