CVE-2026-20245

CISA KEV

ACT NOW Priority: 0.00 BB Relevance: 5/100

Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

CISA Known Exploited Vulnerability

Vendor / Product Cisco — Catalyst SD-WAN Manager

Date Added 2026-06-09

Remediation Due 2026-06-23

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx ; https://nvd.nist.gov/vuln/detail/CVE-2026-20245

Weakness Classification (1)

CWE-116

Affected Software (16)

Vendor	Product	Version
cisco	catalyst_sd-wan_manager	< 20.9.9.1
cisco	catalyst_sd-wan_manager	20.10 – 20.12.5.4
cisco	catalyst_sd-wan_manager	20.12.6 – 20.12.6.2
cisco	catalyst_sd-wan_manager	20.13 – 20.15.4.4
cisco	catalyst_sd-wan_manager	20.15.5 – 20.15.5.2
cisco	catalyst_sd-wan_manager	20.16 – 20.18.2.2
cisco	catalyst_sd-wan_manager	26.1 – 26.1.1.1
cisco	catalyst_sd-wan_manager	20.12.7
cisco	sd-wan_vsmart_controller	< 20.9.9.1
cisco	sd-wan_vsmart_controller	20.10 – 20.12.5.4
cisco	sd-wan_vsmart_controller	20.12.6 – 20.12.6.2
cisco	sd-wan_vsmart_controller	20.13 – 20.15.4.4
cisco	sd-wan_vsmart_controller	20.15.5 – 20.15.5.2
cisco	sd-wan_vsmart_controller	20.16 – 20.18.2.2
cisco	sd-wan_vsmart_controller	26.1 – 26.1.1.1
cisco	sd-wan_vsmart_controller	20.12.7