A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager

CVE-2026-20210 is a privilege/scope-enforcement flaw in the web UI of Cisco Catalyst SD-WAN Manager (formerly vManage). An authenticated user holding only *read-only* role membership can drive UI actions that modify device configurations and templates, and on top of that the UI fails to redact sensitive fields (CWE-779) inside templates and config previews — secrets, keys, and credentials embedded in templates are visible to roles that shouldn't see them. Affected trains span 20.9.x through 20.9.8, 20.10–20.12.4, 20.13–20.14, 20.15–20.15.4.3, 20.16–20.18.2.1, and 26.1–26.1.1.0; Cisco shipped fixes in 20.9.9.1, 20.12.5.4, 20.15.4.4, 20.18.2.2, and 26.1.1.1.

Cisco's 5.4 MEDIUM label tracks the CVSS math (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) — partial confidentiality, partial integrity, no availability, and a *real* authentication gate. That math is fair. The bug does NOT yield unauthenticated RCE on the SD-WAN control plane, and it does not bypass tenant isolation or pivot to edge routers directly. It's a lateral-privilege issue gated by an existing valid account. Vendor severity matches reality here; the hype upgrade temptation comes only from the high-value role of the affected box, not from the chain itself.

Why this verdict

• Authentication gate is real: PR:L requires a working read-only account. That alone removes ~99% of opportunistic internet attackers.
• Exposure population is tiny: vManage is almost universally deployed behind management VRFs, jump hosts, or VPN-only access. Internet-facing population per Censys/Shodan is in the low hundreds globally.
• No KEV, no PoC, EPSS 0.0019: all three exploitation-likelihood signals agree this is not under active attack.
• Role multiplier: SD-WAN Manager is a canonical high-value-role component (network orchestration plane). In a typical enterprise deployment the chain succeeds within the bounds of CVSS — secret disclosure from templates and partial config modification — but does NOT cleanly extend to full edge-router takeover because of I:L scoring and change-control friction. Blast radius lands at tenant-of-vManage, not fleet supply-chain pivot, so the high-value-role floor lifts the verdict to MEDIUM but does not break into HIGH.
• Sibling-CVE context bumps urgency, not severity: CVE-2026-20245 in the same product is being actively exploited; that means SD-WAN Manager is on attackers' workbench right now. Patching this CVE in the same maintenance window as the KEV-listed sibling is the pragmatic move.

Why not higher?

HIGH would require either unauthenticated reach, a clean integrity bypass that reliably pushes attacker-controlled config to edge routers, or active in-the-wild exploitation. None of those are present. CVSS I:L (not I:H) is Cisco's own admission that the integrity reach is bounded.

Why not lower?

LOW is wrong because the affected component is an SD-WAN orchestration plane — a high-value-role box where any privilege-boundary failure is meaningful, and because secrets stored in templates (IPSec PSKs, SNMP communities, BGP MD5) genuinely leak to roles that shouldn't see them. That is more than backlog hygiene.

1. Audit and prune read-only vManage accounts — Inventory every local, TACACS+, RADIUS, and SAML-mapped role that resolves to read-only on vManage. Disable dormant accounts (>30 days no login) and revoke third-party MSP/auditor logins not currently in active engagement. Complete within the noisgate mitigation window for MEDIUM — note: MEDIUM has no formal mitigation SLA, treat as routine within 30 days because of the active sibling-CVE exploitation context.
2. Enforce MFA on all vManage role-bearing identities — PR:L collapses to PR:N for any attacker who phishes a read-only credential. SAML/TACACS+ federations must require MFA. Push to the identity provider, not vManage — vManage's native local-auth MFA is weak. Within 30 days.
3. Move secrets out of inline template fields — Replace inline IPSec PSKs, SNMP communities, and credentials in feature templates with references to an external secret store or per-device variables. This neutralizes the CWE-779 disclosure pathway even on unpatched vManage. Within 30 days.
4. Enable and ship vManage audit logs to SIEM with a write-action-by-read-only-role rule — Detection rule: role IN (basic, operator, read-only) AND http_method IN (POST, PUT, DELETE) AND endpoint IN (/dataservice/template/*, /dataservice/device/action/*). Alert immediately on match. Within 14 days.
5. Restrict vManage UI to a dedicated management VRF / bastion — If vManage is reachable from a general-purpose corporate VLAN or — worst case — the internet, put it behind a jump host and a network ACL limiting source IPs to the NOC subnet. Within 30 days.

Run on the vManage appliance shell as a user with vshell access, or from an auditor workstation that can SSH to vManage. Example: ./check-cve-2026-20210.sh 10.20.30.40 where the argument is the vManage management IP. Requires SSH credentials with shell access, OR root on the appliance itself. The script reads the running vManage version and compares against Cisco's fixed-version matrix.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-20210 — Cisco Catalyst SD-WAN Manager (vManage)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u

TARGET="${1:-localhost}"

get_version() {
  if [[ "$TARGET" == "localhost" ]]; then
    # On-appliance: read directly
    if command -v vshell >/dev/null 2>&1; then
      vshell -c 'show version' 2>/dev/null | awk '/version/ {print $2; exit}'
    elif [[ -r /etc/viptela/version ]]; then
      cat /etc/viptela/version
    fi
  else
    # Remote: SSH and pull show version
    ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 "$TARGET" \
      "show version" 2>/dev/null | awk '/version/ {print $2; exit}'
  fi
}

VER="$(get_version | tr -d '[:space:]')"
if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not determine vManage version on $TARGET"
  exit 2
fi

echo "Detected vManage version: $VER"

# Compare against Cisco fixed-version matrix
# Fixed: 20.9.9.1, 20.12.5.4, 20.15.4.4, 20.18.2.2, 26.1.1.1
vercmp() {
  # returns 0 if $1 >= $2
  printf '%s\n%s\n' "$2" "$1" | sort -V -C
}

case "$VER" in
  20.9.*)   FIXED="20.9.9.1" ;;
  20.1[0-2].*) FIXED="20.12.5.4" ;;
  20.1[3-4].*) FIXED="20.15.4.4" ;;
  20.15.*)  FIXED="20.15.4.4" ;;
  20.1[6-8].*) FIXED="20.18.2.2" ;;
  26.1.*)   FIXED="26.1.1.1" ;;
  *)
    echo "UNKNOWN: version $VER not in known affected/fixed train"
    exit 2
    ;;
esac

if vercmp "$VER" "$FIXED"; then
  echo "PATCHED: $VER >= $FIXED"
  exit 0
else
  echo "VULNERABLE: $VER < $FIXED  (CVE-2026-20210)"
  exit 1
fi

Sources

1. Cisco Security Advisory — SD-WAN Manager Multiple Vulnerabilities (cisco-sa-sdwan-mltvnps2-JxpWm7R)
2. Cisco Security Advisory — SD-WAN Authenticated Privilege Escalation
3. Help Net Security — Cisco SD-WAN zero-day coverage (sibling CVE context)
4. The Hacker News — Cisco Catalyst SD-WAN Manager CVE-2026-20245 actively exploited
5. runZero — Cisco Catalyst SD-WAN vulnerability landscape
6. CSA Singapore — Vulnerability in Cisco Catalyst SD-WAN Manager
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS Model