VulnRadar

Data against noise.

Built with NaN
Page generated: 11 Nov 2026, 05:56 UTC
← Dashboard

CVE-2026-20128

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an aff…

Read full description
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.
CVSS 7.5 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.2/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 7.5: +1.12
  • Fresh EPSS: 8.35%: +0.04

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 11 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

The Hacker News
Press · 15 May 2026, 07:00 · CISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access Exploits - The Hacker News
Cisco Talos Blog
Press · 14 May 2026, 07:00 · Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities - Cisco Talos Blog
Cybersecurity Dive
Press · 21 Apr 2026, 07:00 · CISA confirms exploitation of 3 more Cisco networking device vulnerabilities - Cybersecurity Dive
The Hacker News
Press · 21 Apr 2026, 07:00 · CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines - The Hacker News
Help Net Security
Press · 21 Apr 2026, 07:00 · CISA flags another Cisco Catalyst SD-WAN Manager bug as exploited (CVE-2026-20133) - Help Net Security
See all 11 source documents
Cybersecurity Dive
Press · 17 Mar 2026, 07:00 · Security teams might be overlooking wider threat to Cisco SD-WAN - Cybersecurity Dive
Security Affairs
Press · 06 Mar 2026, 08:00 · Cisco flags ongoing exploitation of two recently patched Catalyst SD-WAN flaws - Security Affairs
The Register
Press · 06 Mar 2026, 08:00 · Cisco warns of two more SD-WAN bugs under active attack - The Register
The Hacker News
Press · 05 Mar 2026, 08:00 · Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities - The Hacker News
SecurityWeek
Press · 05 Mar 2026, 08:00 · Cisco Warns of More Catalyst SD-WAN Flaws Exploited in the Wild - SecurityWeek
BleepingComputer
Press · 05 Mar 2026, 08:00 · Cisco flags more SD-WAN flaws as actively exploited in attacks - BleepingComputer

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.2 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 7.5; EPSS 8.3%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
local access, high privileges, no user interaction, additional attack conditions.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:00.097835+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Published
25 Feb 2026, 16:14
First press mention
05 Mar 2026, 08:00
Added to the CISA KEV catalog
20 Apr 2026, 00:00
Latest press mention
15 May 2026, 07:00
Score calculated
05 Nov 2026, 14:00
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar