A vulnerability in the Data Collection Agent

Cisco says CVE-2026-20128 is in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager and stems from a recoverable credential file that can be fetched with a crafted HTTP request. The important version reality is: affected releases are before 20.18 for this CVE, with train-specific fixes including 20.9.8.2 and 20.12.5.3, while Cisco explicitly says releases 20.18 and later are not affected.

The vendor's HIGH 7.5 label is directionally right, but the user-supplied CVSS vector is stale/misleading for operational prioritization. Cisco's March 18, 2026 advisory update describes unauthenticated remote access to the credential file and Cisco later confirmed active exploitation in March 2026, so this is not a theoretical local-only password-storage issue anymore; it is a remotely reachable management-plane secret exposure with real intrusion evidence.

Why this verdict

• Up from the user-supplied local-only story: Cisco's March 18, 2026 advisory text says the attacker can send a crafted HTTP request and read the DCA credential file remotely and unauthenticated, which is a materially more dangerous starting point than AV:L/PR:H.
• KEV beats EPSS here: active exploitation and KEV listing are hard evidence of operational attacker interest; low EPSS is downward pressure for mass exploitation probability, not proof of low enterprise risk.
• Management-plane exposure is the amplifier: if SD-WAN Manager is exposed, this hits a control component with outsized follow-on value for lateral movement and policy abuse across the fabric.
• But friction is real: many enterprises do not expose SD-WAN Manager broadly, and Cisco's own hardening guidance assumes it should sit behind filtering devices and trusted-host controls.
• Impact is meaningful but not maximal: the immediate win is DCA privileges and access to another affected system, not guaranteed root on every controller from a single packet.

Why not higher?

This is not an every-host wormable internet RCE. The attack still depends on the SD-WAN Manager management surface being reachable and the resulting privilege is narrower than full administrative or root control, so it does not justify a CRITICAL bucket on exposure mechanics alone.

Why not lower?

Dropping this to MEDIUM would ignore the two strongest signals in patch triage: confirmed exploitation and management-plane value. When attackers are already using a remotely reachable path against SD-WAN infrastructure, the right mental model is 'crown-jewel exposure with friction,' not 'just another credential-storage weakness.'

1. Block untrusted access to SD-WAN Manager now — Put SD-WAN Manager behind VPN, jump host, or explicit trusted-host ACLs and remove direct internet reachability immediately, within hours because exploitation is confirmed. This is the fastest way to break step 1 of the attack path while patching is scheduled.
2. Hunt the Cisco IoC path — Review /var/log/nms/containers/service-proxy/serviceproxy-access.log for requests to the published .dca path and preserve logs centrally immediately, within hours. This gives you a direct, vendor-supplied signal for attempted or successful exploitation.
3. Restrict management-plane protocols — Allow only known admin workstations and required control-plane peers to reach the Manager on required ports immediately, within hours. Even if you cannot patch today, shrinking the source IP set sharply reduces exploitability.
4. Rotate exposed secrets and review DCA use — After any suspected hit, rotate credentials associated with DCA workflows and validate whether unexpected DCA sessions or lateral access occurred immediately, within hours. The vulnerability's value is the stolen secret; burn it fast.
5. Upgrade to a fixed release — Move each affected train to Cisco's first fixed release or to an unaffected later train as the durable fix. Because this is KEV-listed/actively exploited, treat remediation as patch immediately, within hours rather than waiting for the normal HIGH deadline.

Run this from an auditor workstation that can SSH to each Cisco Catalyst SD-WAN Manager node. Invoke it as ./check_cve_2026_20128.sh sdwan-mgr01.example.com admin and use an account allowed to run request nms application-server version in privileged EXEC; no root shell is required.

#!/usr/bin/env bash
# check_cve_2026_20128.sh
# Determine likely exposure to CVE-2026-20128 on Cisco Catalyst SD-WAN Manager.
# Usage: ./check_cve_2026_20128.sh <host> [user]
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN, 3 USAGE/SSH ERROR

set -u

HOST="${1:-}"
USER="${2:-admin}"

if [[ -z "$HOST" ]]; then
  echo "UNKNOWN - usage: $0 <host> [user]"
  exit 3
fi

SSH_OPTS=( -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new )
CMD='request nms application-server version'
RAW_OUTPUT=$(ssh "${SSH_OPTS[@]}" "${USER}@${HOST}" "$CMD" 2>/dev/null)
SSH_RC=$?

if [[ $SSH_RC -ne 0 || -z "$RAW_OUTPUT" ]]; then
  echo "UNKNOWN - unable to run version command over SSH on ${HOST}"
  exit 3
fi

# Expected sample: "NMS application server is running version ... on vManage version 20.12.5.2"
VERSION=$(echo "$RAW_OUTPUT" | sed -nE 's/.*vManage version ([0-9]+\.[0-9]+(\.[0-9]+){0,2}).*/\1/p' | head -n1)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - could not parse vManage version from: $RAW_OUTPUT"
  exit 2
fi

ver_ge() {
  # returns 0 if $1 >= $2
  local IFS=.
  local i
  local -a a=($1) b=($2)
  local len=${#a[@]}
  (( ${#b[@]} > len )) && len=${#b[@]}
  for ((i=${#a[@]}; i<len; i++)); do a[i]=0; done
  for ((i=${#b[@]}; i<len; i++)); do b[i]=0; done
  for ((i=0; i<len; i++)); do
    ((10#${a[i]} > 10#${b[i]})) && return 0
    ((10#${a[i]} < 10#${b[i]})) && return 1
  done
  return 0
}

MAJOR_MINOR=$(echo "$VERSION" | awk -F. '{print $1"."$2}')

# Cisco advisory logic for CVE-2026-20128:
# - 20.18 and later: not affected for this CVE
# - 20.9 fixed in 20.9.8.2
# - 20.10.x and 20.11.x: vulnerable; fix requires move to 20.12.6.1
# - 20.12 fixed in 20.12.5.3 (and 20.12.6.1 also fixed)
# - 20.13.x and 20.14.x: vulnerable; fix requires move to 20.15.4.2
# - 20.15 fixed in 20.15.4.2
# - 20.16.x: vulnerable; fix requires move to 20.18.2.1
# - Earlier than 20.9: treat as vulnerable/migrate

if ver_ge "$VERSION" "20.18.0"; then
  echo "PATCHED - ${HOST} is running ${VERSION}; Cisco states 20.18 and later are not affected by CVE-2026-20128"
  exit 0
fi

case "$MAJOR_MINOR" in
  20.9)
    if ver_ge "$VERSION" "20.9.8.2"; then
      echo "PATCHED - ${HOST} is running ${VERSION}; fixed for CVE-2026-20128 in 20.9.8.2"
      exit 0
    else
      echo "VULNERABLE - ${HOST} is running ${VERSION}; 20.9 requires at least 20.9.8.2"
      exit 1
    fi
    ;;
  20.10|20.11)
    echo "VULNERABLE - ${HOST} is running ${VERSION}; this train requires upgrade to 20.12.6.1 or later fixed train"
    exit 1
    ;;
  20.12)
    if ver_ge "$VERSION" "20.12.5.3"; then
      echo "PATCHED - ${HOST} is running ${VERSION}; 20.12 fixed in 20.12.5.3"
      exit 0
    else
      echo "VULNERABLE - ${HOST} is running ${VERSION}; 20.12 requires at least 20.12.5.3"
      exit 1
    fi
    ;;
  20.13|20.14)
    echo "VULNERABLE - ${HOST} is running ${VERSION}; this train requires upgrade to 20.15.4.2 or later fixed train"
    exit 1
    ;;
  20.15)
    if ver_ge "$VERSION" "20.15.4.2"; then
      echo "PATCHED - ${HOST} is running ${VERSION}; 20.15 fixed in 20.15.4.2"
      exit 0
    else
      echo "VULNERABLE - ${HOST} is running ${VERSION}; 20.15 requires at least 20.15.4.2"
      exit 1
    fi
    ;;
  20.16)
    echo "VULNERABLE - ${HOST} is running ${VERSION}; this train requires upgrade to 20.18.2.1 or later fixed train"
    exit 1
    ;;
  20.17)
    echo "UNKNOWN - ${HOST} is running ${VERSION}; 20.17 train not explicitly covered in the reviewed advisory text, verify with Cisco TAC"
    exit 2
    ;;
  *)
    # Any version below 20.9 or unrecognized pre-20.18 build: conservative call
    if ver_ge "$VERSION" "20.0.0"; then
      echo "VULNERABLE - ${HOST} is running ${VERSION}; pre-20.18 release not known-safe for CVE-2026-20128"
      exit 1
    else
      echo "UNKNOWN - parsed unusual version ${VERSION}; verify manually"
      exit 2
    fi
    ;;
esac

Sources

1. Cisco Security Advisory: Cisco Catalyst SD-WAN Vulnerabilities
2. Cisco mirror of advisory
3. NVD CVE-2026-20128
4. CVE Program record
5. CISA Known Exploited Vulnerabilities Catalog
6. Cisco SD-WAN Command Reference PDF
7. Cisco DevNet API: Find Software Version