CVE-2026-20209: Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker with read-only permissions to elevate their privileges from low to high and perform actions as a high-privileged user. This vulnerability exists because sensitive session information is recorded in audit logs. An attacker could exploit this vulnerability by elevating their read-only permissions in Cisco Catalyst SD-WAN Manager to those of a high-privileged user. A successful exploit could allow the attacker to perform actions as a high-privileged user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20209?
CVE-2026-20209 is rated as a moderate severity vulnerability.
How do I fix CVE-2026-20209?
To mitigate CVE-2026-20209, users should upgrade to the latest version of Cisco Catalyst SD-WAN Manager that addresses this issue.
What type of vulnerability is CVE-2026-20209?
CVE-2026-20209 is a privilege escalation vulnerability affecting the web UI of Cisco Catalyst SD-WAN Manager.
Who is affected by CVE-2026-20209?
Authenticated users with read-only permissions in Cisco Catalyst SD-WAN Manager are affected by CVE-2026-20209.
What actions can an attacker perform due to CVE-2026-20209?
An attacker exploiting CVE-2026-20209 can elevate their permissions to perform actions as a high-privileged user.