CVE-2026-20126 - Vulnerability Details - OpenCVE

A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system. This vulnerability is due to an insufficient user authentication mechanism in the REST API. An attacker could exploit this vulnerability by sending a request to the REST API of the affected system. A successful exploit could allow the attacker to gain root privileges on the underlying operating system.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v

History

Wed, 25 Feb 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system. This vulnerability is due to an insufficient user authentication mechanism in the REST API. An attacker could exploit this vulnerability by sending a request to the REST API of the affected system. A successful exploit could allow the attacker to gain root privileges on the underlying operating system.
Title		Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability
Weaknesses		CWE-648
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2026-02-25T16:13:58.856Z

Updated: 2026-02-25T19:05:52.731Z

Reserved: 2025-10-08T11:59:15.378Z

Link: CVE-2026-20126

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-02-25T17:25:28.840

Modified: 2026-02-25T17:25:28.840

Link: CVE-2026-20126

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20126", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.378Z", "datePublished": "2026-02-25T16:13:58.856Z", "dateUpdated": "2026-02-25T19:05:52.731Z"}, "containers": {"cna": {"title": "Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system.\r\n\r\nThis vulnerability is due to an insufficient user authentication mechanism in the REST API. An attacker could exploit this vulnerability by sending a request to the REST API of the affected system. A successful exploit could allow the attacker to gain root privileges on the underlying operating system."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v", "name": "cisco-sa-sdwan-authbp-qwCX8D4v"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-sdwan-authbp-qwCX8D4v", "discovery": "INTERNAL", "defects": ["CSCws93470"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Incorrect Use of Privileged APIs", "type": "cwe", "cweId": "CWE-648"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Catalyst SD-WAN Manager", "versions": [{"version": "20.1.12", "status": "affected"}, {"version": "19.2.1", "status": "affected"}, {"version": "18.4.4", "status": "affected"}, {"version": "18.4.5", "status": "affected"}, {"version": "20.1.1.1", "status": "affected"}, {"version": "20.1.1", "status": "affected"}, {"version": "19.3.0", "status": "affected"}, {"version": "19.2.2", "status": "affected"}, {"version": "19.2.099", "status": "affected"}, {"version": "18.3.6", "status": "affected"}, {"version": "18.3.7", "status": "affected"}, {"version": "19.2.0", "status": "affected"}, {"version": "18.3.8", "status": "affected"}, {"version": "19.0.0", "status": "affected"}, {"version": "19.1.0", "status": "affected"}, {"version": "18.4.302", "status": "affected"}, {"version": "18.4.303", "status": "affected"}, {"version": "19.2.097", "status": "affected"}, {"version": "19.2.098", "status": "affected"}, {"version": "17.2.10", "status": "affected"}, {"version": "18.3.6.1", "status": "affected"}, {"version": "19.0.1a", "status": "affected"}, {"version": "18.2.0", "status": "affected"}, {"version": "18.4.3", "status": "affected"}, {"version": "18.4.1", "status": "affected"}, {"version": "17.2.8", "status": "affected"}, {"version": "18.3.3.1", "status": "affected"}, {"version": "18.4.0", "status": "affected"}, {"version": "18.3.1", "status": "affected"}, {"version": "17.2.6", "status": "affected"}, {"version": "17.2.9", "status": "affected"}, {"version": "18.3.4", "status": "affected"}, {"version": "17.2.5", "status": "affected"}, {"version": "18.3.1.1", "status": "affected"}, {"version": "18.3.5", "status": "affected"}, {"version": "18.4.0.1", "status": "affected"}, {"version": "18.3.3", "status": "affected"}, {"version": "17.2.7", "status": "affected"}, {"version": "17.2.4", "status": "affected"}, {"version": "18.3.0", "status": "affected"}, {"version": "19.2.3", "status": "affected"}, {"version": "18.4.501_ES", "status": "affected"}, {"version": "20.3.1", "status": "affected"}, {"version": "20.1.2", "status": "affected"}, {"version": "19.2.929", "status": "affected"}, {"version": "19.2.31", "status": "affected"}, {"version": "20.3.2", "status": "affected"}, {"version": "19.2.32", "status": "affected"}, {"version": "20.3.2_925", "status": "affected"}, {"version": "20.3.2.1", "status": "affected"}, {"version": "20.3.2.1_927", "status": "affected"}, {"version": "18.4.6", "status": "affected"}, {"version": "20.1.2_937", "status": "affected"}, {"version": "20.4.1", "status": "affected"}, {"version": "20.3.2_928", "status": "affected"}, {"version": "20.3.2_929", "status": "affected"}, {"version": "20.4.1.0.1", "status": "affected"}, {"version": "20.3.2.1_930", "status": "affected"}, {"version": "19.2.4", "status": "affected"}, {"version": "20.5.0.1.1", "status": "affected"}, {"version": "20.4.1.1", "status": "affected"}, {"version": "20.3.3", "status": "affected"}, {"version": "19.2.4.0.1", "status": "affected"}, {"version": "20.3.2_937", "status": "affected"}, {"version": "20.3.3.1", "status": "affected"}, {"version": "20.5.1", "status": "affected"}, {"version": "20.1.3", "status": "affected"}, {"version": "20.3.3.0.4", "status": "affected"}, {"version": "20.3.3.1.2", "status": "affected"}, {"version": "20.3.3.1.1", "status": "affected"}, {"version": "20.4.1.2", "status": "affected"}, {"version": "20.3.3.0.2", "status": "affected"}, {"version": "20.4.1.1.5", "status": "affected"}, {"version": "20.4.1.0.01", "status": "affected"}, {"version": "20.4.1.0.02", "status": "affected"}, {"version": "20.3.3.1.7", "status": "affected"}, {"version": "20.3.3.1.5", "status": "affected"}, {"version": "20.5.1.0.1", "status": "affected"}, {"version": "20.3.3.1.10", "status": "affected"}, {"version": "20.3.3.0.8", "status": "affected"}, {"version": "20.4.2", "status": "affected"}, {"version": "20.4.2.0.1", "status": "affected"}, {"version": "20.3.4", "status": "affected"}, {"version": "20.3.3.0.14", "status": "affected"}, {"version": "19.2.4.0.8", "status": "affected"}, {"version": "19.2.4.0.9", "status": "affected"}, {"version": "20.3.4.0.1", "status": "affected"}, {"version": "20.3.2.0.5", "status": "affected"}, {"version": "20.6.1", "status": "affected"}, {"version": "20.5.1.0.2", "status": "affected"}, {"version": "20.3.3.0.17", "status": "affected"}, {"version": "20.6.1.1", "status": "affected"}, {"version": "20.6.0.18.3", "status": "affected"}, {"version": "20.3.2.0.6", "status": "affected"}, {"version": "20.6.0.18.4", "status": "affected"}, {"version": "20.4.2.0.2", "status": "affected"}, {"version": "20.3.3.0.16", "status": "affected"}, {"version": "20.3.4.0.5", "status": "affected"}, {"version": "20.6.1.0.1", "status": "affected"}, {"version": "20.3.4.0.6", "status": "affected"}, {"version": "20.6.2", "status": "affected"}, {"version": "20.7.1EFT2", "status": "affected"}, {"version": "20.3.4.0.9", "status": "affected"}, {"version": "20.3.4.0.11", "status": "affected"}, {"version": "20.4.2.0.4", "status": "affected"}, {"version": "20.3.3.0.18", "status": "affected"}, {"version": "20.7.1", "status": "affected"}, {"version": "20.6.2.1", "status": "affected"}, {"version": "20.3.4.1", "status": "affected"}, {"version": "20.5.1.1", "status": "affected"}, {"version": "20.4.2.1", "status": "affected"}, {"version": "20.4.2.1.1", "status": "affected"}, {"version": "20.3.4.1.1", "status": "affected"}, {"version": "20.3.813", "status": "affected"}, {"version": "20.3.4.0.19", "status": "affected"}, {"version": "20.4.2.2.1", "status": "affected"}, {"version": "20.5.1.2", "status": "affected"}, {"version": "20.3.4.2", "status": "affected"}, {"version": "20.3.814", "status": "affected"}, {"version": "20.4.2.2", "status": "affected"}, {"version": "20.6.2.2", "status": "affected"}, {"version": "20.3.4.2.1", "status": "affected"}, {"version": "20.7.1.1", "status": "affected"}, {"version": "20.3.4.1.2", "status": "affected"}, {"version": "20.6.2.2.2", "status": "affected"}, {"version": "20.3.4.0.20", "status": "affected"}, {"version": "20.6.2.2.3", "status": "affected"}, {"version": "20.4.2.2.2", "status": "affected"}, {"version": "20.3.5", "status": "affected"}, {"version": "20.6.2.0.4", "status": "affected"}, {"version": "20.4.2.2.3", "status": "affected"}, {"version": "20.3.4.0.24", "status": "affected"}, {"version": "20.6.2.2.7", "status": "affected"}, {"version": "20.6.3", "status": "affected"}, {"version": "20.3.4.2.2", "status": "affected"}, {"version": "20.4.2.2.4", "status": "affected"}, {"version": "20.7.1.0.2", "status": "affected"}, {"version": "20.8.1", "status": "affected"}, {"version": "20.3.5.0.8", "status": "affected"}, {"version": "20.3.5.0.9", "status": "affected"}, {"version": "20.4.2.2.8", "status": "affected"}, {"version": "20.3.5.0.7", "status": "affected"}, {"version": "20.6.3.0.7", "status": "affected"}, {"version": "20.6.3.0.5", "status": "affected"}, {"version": "20.6.3.0.10", "status": "affected"}, {"version": "20.6.3.0.2", "status": "affected"}, {"version": "20.7.2", "status": "affected"}, {"version": "20.9.1EFT2", "status": "affected"}, {"version": "20.6.3.0.11", "status": "affected"}, {"version": "20.6.3.1", "status": "affected"}, {"version": "20.6.3.0.14", "status": "affected"}, {"version": "20.6.4", "status": "affected"}, {"version": "20.9.1", "status": "affected"}, {"version": "20.6.3.0.19", "status": "affected"}, {"version": "20.6.3.0.18", "status": "affected"}, {"version": "20.3.6", "status": "affected"}, {"version": "20.9.1.1", "status": "affected"}, {"version": "20.6.3.0.23", "status": "affected"}, {"version": "20.6.4.0.4", "status": "affected"}, {"version": "20.6.3.0.25", "status": "affected"}, {"version": "20.6.5", "status": "affected"}, {"version": "20.6.3.0.27", "status": "affected"}, {"version": "20.9.2", "status": "affected"}, {"version": "20.9.2.1", "status": "affected"}, {"version": "20.6.3.0.29", "status": "affected"}, {"version": "20.6.3.0.31", "status": "affected"}, {"version": "20.6.3.0.32", "status": "affected"}, {"version": "20.10.1", "status": "affected"}, {"version": "20.6.3.0.33", "status": "affected"}, {"version": "20.9.2.0.01", "status": "affected"}, {"version": "20.9.1_LI_Images", "status": "affected"}, {"version": "20.10.1_LI_Images", "status": "affected"}, {"version": "20.9.2_LI_Images", "status": "affected"}, {"version": "20.3.7", "status": "affected"}, {"version": "20.9.3", "status": "affected"}, {"version": "20.6.5.1", "status": "affected"}, {"version": "20.11.1", "status": "affected"}, {"version": "20.11.1_LI_Images", "status": "affected"}, {"version": "20.9.3_LI_ Images", "status": "affected"}, {"version": "20.6.3.1.1", "status": "affected"}, {"version": "20.9.3.0.2", "status": "affected"}, {"version": "20.6.5.1.2", "status": "affected"}, {"version": "20.9.3.0.3", "status": "affected"}, {"version": "20.4.2.3", "status": "affected"}, {"version": "20.6.3.2", "status": "affected"}, {"version": "20.6.4.1", "status": "affected"}, {"version": "20.6.3.0.38", "status": "affected"}, {"version": "20.6.3.0.39", "status": "affected"}, {"version": "20.3.5.1", "status": "affected"}, {"version": "20.3.4.3", "status": "affected"}, {"version": "20.9.3.1", "status": "affected"}, {"version": "20.3.3.2", "status": "affected"}, {"version": "20.6.5.2", "status": "affected"}, {"version": "20.3.7.1", "status": "affected"}, {"version": "20.10.1.1", "status": "affected"}, {"version": "20.6.5.2.1", "status": "affected"}, {"version": "20.3.4.0.25", "status": "affected"}, {"version": "20.6.2.2.4", "status": "affected"}, {"version": "20.6.1.2", "status": "affected"}, {"version": "20.11.1.1", "status": "affected"}, {"version": "20.9.3.0.5", "status": "affected"}, {"version": "20.3.4.0.26", "status": "affected"}, {"version": "20.6.5.1.3", "status": "affected"}, {"version": "20.6.3.0.40", "status": "affected"}, {"version": "20.1.3.1", "status": "affected"}, {"version": "20.9.2.2", "status": "affected"}, {"version": "20.6.5.2.3", "status": "affected"}, {"version": "20.6.5.1.4", "status": "affected"}, {"version": "20.6.5.3", "status": "affected"}, {"version": "20.6.3.0.41", "status": "affected"}, {"version": "20.9.3.0.7", "status": "affected"}, {"version": "20.6.5.1.5", "status": "affected"}, {"version": "20.9.3.0.4", "status": "affected"}, {"version": "20.6.4.0.19", "status": "affected"}, {"version": "20.6.5.1.6", "status": "affected"}, {"version": "20.9.3.0.8", "status": "affected"}, {"version": "20.6.3.3", "status": "affected"}, {"version": "20.3.7.2", "status": "affected"}, {"version": "20.6.5.4", "status": "affected"}, {"version": "20.6.5.1.7", "status": "affected"}, {"version": "20.9.3.0.12", "status": "affected"}, {"version": "20.6.4.2", "status": "affected"}, {"version": "20.6.5.5", "status": "affected"}, {"version": "20.9.3.2", "status": "affected"}, {"version": "20.11.1.2", "status": "affected"}, {"version": "20.6.3.4", "status": "affected"}, {"version": "20.10.1.2", "status": "affected"}, {"version": "20.6.5.1.9", "status": "affected"}, {"version": "20.9.3.0.16", "status": "affected"}, {"version": "20.6.3.0.45", "status": "affected"}, {"version": "20.6.5.1.10", "status": "affected"}, {"version": "20.9.3.0.17", "status": "affected"}, {"version": "20.6.5.2.4", "status": "affected"}, {"version": "20.6.4.0.21", "status": "affected"}, {"version": "20.9.3.0.18", "status": "affected"}, {"version": "20.6.3.0.46", "status": "affected"}, {"version": "20.6.3.0.47", "status": "affected"}, {"version": "20.9.2.3", "status": "affected"}, {"version": "20.9.3.2_LI_Images", "status": "affected"}, {"version": "20.9.3.0.21", "status": "affected"}, {"version": "20.9.3.0.20", "status": "affected"}, {"version": "20.9.4_LI_Images", "status": "affected"}, {"version": "20.9.4", "status": "affected"}, {"version": "20.6.5.1.11", "status": "affected"}, {"version": "20.12.1", "status": "affected"}, {"version": "20.12.1_LI_Images", "status": "affected"}, {"version": "20.6.5.1.13", "status": "affected"}, {"version": "20.9.3.0.23", "status": "affected"}, {"version": "20.6.5.2.8", "status": "affected"}, {"version": "20.9.4.1", "status": "affected"}, {"version": "20.9.4.1_LI_Images", "status": "affected"}, {"version": "20.9.3.0.25", "status": "affected"}, {"version": "20.9.3.0.24", "status": "affected"}, {"version": "20.6.5.1.14", "status": "affected"}, {"version": "20.3.8", "status": "affected"}, {"version": "20.6.6", "status": "affected"}, {"version": "20.9.3.0.26", "status": "affected"}, {"version": "20.6.3.0.51", "status": "affected"}, {"version": "20.9.3.0.29", "status": "affected"}, {"version": "20.12.2", "status": "affected"}, {"version": "20.12.2_LI_Images", "status": "affected"}, {"version": "20.6.6.0.1", "status": "affected"}, {"version": "20.13.1_LI_Images", "status": "affected"}, {"version": "20.9.4.0.4", "status": "affected"}, {"version": "20.13.1", "status": "affected"}, {"version": "20.9.4.1.1", "status": "affected"}, {"version": "20.9.5", "status": "affected"}, {"version": "20.9.5_LI_Images", "status": "affected"}, {"version": "20.12.3_LI_Images", "status": "affected"}, {"version": "20.12.3", "status": "affected"}, {"version": "20.9.4.1.3", "status": "affected"}, {"version": "20.6.7", "status": "affected"}, {"version": "20.9.5.1", "status": "affected"}, {"version": "20.9.5.1_LI_Images", "status": "affected"}, {"version": "20.9.4.1.6", "status": "affected"}, {"version": "20.14.1", "status": "affected"}, {"version": "20.14.1_LI_Images", "status": "affected"}, {"version": "20.9.5.2", "status": "affected"}, {"version": "20.9.5.2.1", "status": "affected"}, {"version": "20.9.5.2_LI_Images", "status": "affected"}, {"version": "20.12.3.1", "status": "affected"}, {"version": "20.12.4", "status": "affected"}, {"version": "20.15.1_LI_Images", "status": "affected"}, {"version": "20.15.1", "status": "affected"}, {"version": "20.9.5.1.4", "status": "affected"}, {"version": "20.9.5.2.7", "status": "affected"}, {"version": "20.9.5.2.13", "status": "affected"}, {"version": "20.9.6", "status": "affected"}, {"version": "20.9.6_LI_Images", "status": "affected"}, {"version": "20.9.5.2.14", "status": "affected"}, {"version": "20.6.8", "status": "affected"}, {"version": "20.12.4.0.03", "status": "affected"}, {"version": "20.16.1", "status": "affected"}, {"version": "20.16.1_LI_Images", "status": "affected"}, {"version": "20.12.4_LI_Images", "status": "affected"}, {"version": "20.9.5.2.16", "status": "affected"}, {"version": "20.12.4.0.4", "status": "affected"}, {"version": "20.12.401", "status": "affected"}, {"version": "20.9.5.3", "status": "affected"}, {"version": "20.9.5.3_LI_Images", "status": "affected"}, {"version": "20.12.4.1_LI_Images", "status": "affected"}, {"version": "20.12.4.1", "status": "affected"}, {"version": "20.9.5.2.21", "status": "affected"}, {"version": "20.9.6.0.3", "status": "affected"}, {"version": "20.12.4.0.6", "status": "affected"}, {"version": "20.15.2_LI_Images", "status": "affected"}, {"version": "20.15.2", "status": "affected"}, {"version": "20.12.4_Monthly_ES5", "status": "affected"}, {"version": "20.12.5", "status": "affected"}, {"version": "20.12.5_LI_Images", "status": "affected"}, {"version": "20.9.7_LI _Images", "status": "affected"}, {"version": "20.9.7", "status": "affected"}, {"version": "20.15.3", "status": "affected"}, {"version": "20.15.3_ LI _Images", "status": "affected"}, {"version": "20.12.501", "status": "affected"}, {"version": "20.12.5.1_LI_Images", "status": "affected"}, {"version": "20.12.5.1", "status": "affected"}, {"version": "20.12.5.2_LI_Images", "status": "affected"}, {"version": "20.12.5.2", "status": "affected"}, {"version": "20.15.3.1", "status": "affected"}, {"version": "20.15.4_LI_Images", "status": "affected"}, {"version": "20.15.4", "status": "affected"}, {"version": "20.9.7.1_LI _Images", "status": "affected"}, {"version": "20.9.7.1", "status": "affected"}, {"version": "20.18.1", "status": "affected"}, {"version": "20.18.1_LI_Images", "status": "affected"}, {"version": "20.12.6_LI_Images", "status": "affected"}, {"version": "20.12.6", "status": "affected"}, {"version": "20.12.5.1.01", "status": "affected"}, {"version": "20.9.8", "status": "affected"}, {"version": "20.9.8_LI_Images", "status": "affected"}, {"version": "20.18.2", "status": "affected"}, {"version": "20.15.4.1_LI_Images", "status": "affected"}, {"version": "20.15.4.1", "status": "affected"}, {"version": "20.18.2_LI_Images", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-02-25T16:18:05.423Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20126", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-25T18:19:40.664047Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T19:05:52.731Z"}}]}}