CVEvulnerability

CVE-2026-20126

7.8 HIGH Published 2026-02-25 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-02-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-648

Description

A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system. This vulnerability is due to an insufficient user authentication mechanism in the REST API. An attacker could exploit this vulnerability by sending a request to the REST API of the affected system. A successful exploit could allow the attacker to gain root privileges on the underlying operating system.

Affected configurations

• cisco catalyst sd-wan manager (< 20.9.8.2) • cisco catalyst sd-wan manager (>= 20.11 < 20.12.5.3) • cisco catalyst sd-wan manager (>= 20.13 < 20.15.4.2) • cisco catalyst sd-wan manager (>= 20.16 < 20.18.2.1) • cisco catalyst sd-wan manager 20.12.6

Related

Weakness · CWE (1)

  • CWE-648 Incorrect Use of Privileged APIs weakness

References