CS
Product
Catalyst SD-WAN Manager
On CISA KEVExploited in the wild
92
CVEs
9
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 10High 37Medium 45Low 0
Watch
Add Catalyst SD-WAN Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-20182 In wildKEV | 10.0 | May 14 | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability Affected: before 20.9.9.1; 20.10 before 20.12.5.4; 20.12.6 before 20.12.6.2; 20.13 before 20.15.4.4; 20.15.5 before 20.15.5.2; 20.16 before 20.18.2.2; +2 more |
| CVE-2026-20127 In wildKEV | 10.0 | Feb 25 | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability Affected: before 20.9.8.2; 20.11 before 20.12.5.3; 20.13 before 20.15.4.2; 20.16 before 20.18.2.1; 20.12.6 |
| CVE-2026-76504 In wildKEV | 9.8 | Sep 30 | Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability Affected: before 20.9.10.1; 20.12 before 20.12.8.2; 20.15 before 20.15.6.1; 20.18 before 20.18.4.1; 26.1 before 26.1.2.1; 26.2 |
| CVE-2026-20245 In wildKEV | 7.8 | Jun 4 | Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability Affected: before 20.9.9.1; 20.10 before 20.12.5.4; 20.12.6 before 20.12.6.2; 20.13 before 20.15.4.4; 20.15.5 before 20.15.5.2; 20.16 before 20.18.2.2; +2 more |
| CVE-2022-20775 In wildKEV | 7.8 | Sep 30 | Cisco SD-WAN Software Privilege Escalation Vulnerability Affected: before 20.6.3; 20.7 before 20.7.2; 20.8 |
| CVE-2026-20128 In wildKEV | 7.5 | Feb 25 | Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability Affected: before 20.9.8.2; 20.10 before 20.12.5.3; 20.13 before 20.15.4.2; 20.16 before 20.18; 20.12.6 |
| CVE-2026-20133 In wildKEV | 7.5 | Feb 25 | Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Affected: before 20.9.8.2; 20.10 before 20.12.5.3; 20.13 before 20.15.4.2; 20.16 before 20.18.2.1; 20.12.6 |
| CVE-2026-20262 In wildKEV | 6.5 | Jun 15 | Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability Affected: before 20.9.9.2; 20.10 before 20.12.7.2; 20.13 before 20.15.4.5; 20.15.5 before 20.15.5.3; 20.16 before 20.18.3.1; 26.1 before 26.1.1.2 |
| CVE-2026-20122 In wildKEV | 5.4 | Feb 25 | Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability Affected: before 20.9.8.2; 20.10 before 20.12.5.3; 20.13 before 20.15.4.2; 20.16 before 20.18.2.1; 20.12.6 |
| CVE-2026-20129 | 9.8 | Feb 25 | A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected system as a user who… Affected: before 20.9.8.2; 20.11 before 20.12.5.3; 20.13 before 20.15.4.2; 20.16 before 20.18; 20.12.6 |
| CVE-2023-20252 | 9.8 | Sep 27 | A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain… Affected: 20.9.3.2; 20.11.1.2 |
| CVE-2021-1468 | 9.8 | May 6 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or… Affected: 20.4 before 20.4.1; 20.5 before 20.5.1 |
| CVE-2021-1479 | 9.8 | Apr 8 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to… Affected: 20.4 before 20.4.1 |
| CVE-2021-1301 | 9.8 | Jan 20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device Affected: All versions, or not specified |
| CVE-2021-1300 | 9.8 | Jan 20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device Affected: All versions, or not specified |
| CVE-2023-20214 | 9.1 | Aug 3 | A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to gain read permissions… Affected: 20.6.4 before 20.6.4.2; 20.6.5 before 20.6.5.5; 20.7 before 20.9.3.2; 20.11 before 20.11.1.2; 20.6.3.3 |
| CVE-2022-20696 | 8.8 | Sep 8 | A vulnerability in the binding configuration of Cisco SD-WAN vManage Software containers could allow an unauthenticated, adjacent attacker who has access to the VPN0 logical… Affected: 20.7 before 20.9.1 |
| CVE-2021-1508 | 8.8 | May 6 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or… Affected: 20.4 before 20.4.1; 20.5 before 20.5.1 |
| CVE-2021-1505 | 8.8 | May 6 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or… Affected: 20.4 before 20.4.1; 20.5 before 20.5.1 |
| CVE-2021-1284 | 8.8 | May 6 | A vulnerability in the web-based messaging service interface of Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to bypass authentication and… Affected: 20.4 before 20.4.1; 20.5 before 20.5.1 |
| CVE-2021-1302 | 8.8 | Jan 20 | Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify… Affected: All versions, or not specified |
| CVE-2021-1299 | 8.8 | Jan 20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the… Affected: All versions, or not specified |
| CVE-2021-1298 | 8.8 | Jan 20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the… Affected: All versions, or not specified |
| CVE-2026-20224 | 8.6 | May 14 | Cisco Catalyst SD-WAN Manager XML External Entity Injection Vulnerability Affected: before 20.9.9.1; 20.10 before 20.12.5.4; 20.12.6 before 20.12.6.2; 20.13 before 20.15.4.4; 20.15.5 before 20.15.5.2; 20.16 before 20.18.2.2; +2 more |
| CVE-2021-1279 | 8.6 | Jan 20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device Affected: All versions, or not specified |
| CVE-2021-1274 | 8.6 | Jan 20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device Affected: All versions, or not specified |
| CVE-2021-1273 | 8.6 | Jan 20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device Affected: All versions, or not specified |
| CVE-2020-26071 | 8.4 | Nov 18 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to create or overwrite arbitrary files on an affected device, which could… Affected: 17.2.4; 17.2.5; 17.2.6; 17.2.7; 17.2.8; 17.2.9; +34 more |
| CVE-2020-26064 | 8.1 | Aug 4 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an… Affected: 17.2.4; 17.2.5; 17.2.6; 17.2.7; 17.2.8; 17.2.9; +34 more |
| CVE-2026-20126 | 7.8 | Feb 25 | A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system Affected: before 20.9.8.2; 20.11 before 20.12.5.3; 20.13 before 20.15.4.2; 20.16 before 20.18.2.1; 20.12.6 |
| CVE-2025-20122 | 7.8 | May 7 | A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to gain privileges of the root user on the… Affected: 17.2.4; 17.2.5; 17.2.6; 17.2.7; 17.2.8; 17.2.9; +34 more |
| CVE-2020-26074 | 7.8 | Nov 18 | A vulnerability in system file transfer functions of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to gain escalated privileges on the underlying… Affected: 17.2.4; 17.2.5; 17.2.6; 17.2.7; 17.2.8; 17.2.9; +34 more |
| CVE-2022-20716 | 7.8 | Apr 15 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain escalated privileges Affected: All versions, or not specified |
| CVE-2021-1528 | 7.8 | Jun 4 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system Affected: 20.4 before 20.4.2; 20.5 before 20.5.1 |
| CVE-2021-1514 | 7.8 | May 6 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with Administrator privileges on the… Affected: 20.1 before 20.1.1; 20.3 before 20.3.1; 20.4 before 20.4.1; 20.5 before 20.5.1 |
| CVE-2021-1480 | 7.8 | Apr 8 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to… Affected: 20.4 before 20.4.1 |
| CVE-2021-1137 | 7.8 | Apr 8 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to… Affected: 20.4 before 20.4.1 |
| CVE-2021-1263 | 7.8 | Jan 20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the… Affected: All versions, or not specified |
| CVE-2021-1262 | 7.8 | Jan 20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the… Affected: All versions, or not specified |
| CVE-2021-1261 | 7.8 | Jan 20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the… Affected: All versions, or not specified |
| CVE-2021-1260 | 7.8 | Jan 20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the… Affected: All versions, or not specified |
| CVE-2020-26073 | 7.5 | Nov 18 | A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to gain access to sensitive information Affected: 17.2.4; 17.2.5; 17.2.6; 17.2.7; 17.2.8; 17.2.9; +34 more |
| CVE-2023-20262 | 7.5 | Sep 27 | A vulnerability in the SSH service of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to cause a process crash, resulting in a DoS condition for SSH… Affected: 20.4 before 20.9.3 |
| CVE-2021-1513 | 7.5 | May 6 | A vulnerability in the vDaemon process of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to reload, resulting in a denial of service (DoS)… Affected: before 20.3.1; 20.4 before 20.4.1; 20.5 before 20.5.1 |
| CVE-2021-1275 | 7.5 | May 6 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or… Affected: 20.4 before 20.4.1; 20.5 before 20.5.1 |
| CVE-2021-1241 | 7.5 | Jan 20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device Affected: All versions, or not specified |
| CVE-2021-1278 | 7.5 | Jan 20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device Affected: All versions, or not specified |
| CVE-2022-20739 | 7.3 | Apr 15 | A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as the… Affected: 20.7 |
| CVE-2021-1506 | 7.2 | May 6 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or… Affected: 20.4 before 20.4.1; 20.5 before 20.5.1 |
| CVE-2021-1462 | 6.7 | Nov 18 | A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to elevate privileges on an affected system Affected: 17.2.4; 17.2.5; 17.2.6; 17.2.7; 17.2.8; 17.2.9; +33 more |