A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker with read-only permissions to elevate their privileges from low to high and perform actions as a high-privileged user.
This vulnerability exists because sensitive session information is recorded in audit logs. An attacker could exploit this vulnerability by elevating their read-only permissions in Cisco Catalyst SD-WAN Manager to those of a high-privileged user. A successful exploit could allow the attacker to perform actions as a high-privileged user.
Metrics
Affected Vendors & Products
References
History
Fri, 15 May 2026 11:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Cisco
Cisco catalyst Sd-wan Manager |
|
| Vendors & Products |
Cisco
Cisco catalyst Sd-wan Manager |
Thu, 14 May 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 14 May 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker with read-only permissions to elevate their privileges from low to high and perform actions as a high-privileged user. This vulnerability exists because sensitive session information is recorded in audit logs. An attacker could exploit this vulnerability by elevating their read-only permissions in Cisco Catalyst SD-WAN Manager to those of a high-privileged user. A successful exploit could allow the attacker to perform actions as a high-privileged user. | |
| Title | Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability | |
| Weaknesses | CWE-779 | |
| References |
| |
| Metrics |
cvssV3_1
|
Status: PUBLISHED
Assigner: cisco
Published:
Updated: 2026-05-15T03:56:13.953Z
Reserved: 2025-10-08T11:59:15.398Z
Link: CVE-2026-20209
Updated: 2026-05-14T19:12:48.337Z
Status : Awaiting Analysis
Published: 2026-05-14T17:16:19.750
Modified: 2026-05-14T17:19:57.600
Link: CVE-2026-20209
No data.
OpenCVE Enrichment
Updated: 2026-05-15T11:00:09Z