CVE-2026-20133KEV · OVERDUECWE-200

Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Medium · published February 25, 2026

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 98.3th percentile for exploit probability.

183
days past CISA
deadline
CVSS v3.1
6.5
EPSS
32%
Percentile
98.3
In the wild
Confirmed
What it is

A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system.

This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.32432 · 98.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-02-25T16:13Z
KEV added
2026-04-20 · due 2026-04-23
EPSS history
Timeline
  • 20 APR 00:00Z
    Added to CISA KEV — remediate by Apr 23
    kev
  • 25 FEB 16:13Z
    A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system
    cvelistv5