CVE-2026-20129
Cisco Catayst SD-WAN Authentication Bypass Vulnerability
Severity
Critical 9.8
CVSS 3.1
Exploited
Not listed
EPSS
0.007
52.4th percentile
Discovered by
Vendor
Vendor-published field
Published
Feb 25, 2026
Assigned by cisco
Description
A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected system as a user who has the netadmin role. The vulnerability is due to improper authentication for requests that are sent to the API. An attacker could exploit this vulnerability by sending a crafted request to the API of an affected system. A successful exploit could allow the attacker to execute commands with the privileges of the netadmin role. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.
Weakness: CWE-287
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Catalyst SD-WAN Manager | Network & Security Management | cna-assigner |
Vendor-reported products (1)
- Cisco · Cisco Catalyst SD-WAN Manager